Linux Kernel ipvs ip_vs_nat_icmp ihl memory corruption

Summaryinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel. This affects the function ip_vs_nat_icmp of the component ipvs. Such manipulation of the argument ihl leads to memory corruption. This vulnerability is referenced as CVE-2026-74747. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel (affected version not known). It has been rated as very critical. Affected by this issue is the function ip_vs_nat_icmp of the component ipvs. The manipulation of the argument ihl with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access. One such place reported by Sashiko is ip_vs_nat_icmp() where local process can change the ihl field and after skb_ensure_writable() we can see larger value which is a problem for the ip_send_check(cih) calls. Add check to drop the packet if the ihl field is changed.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-74747 since 08/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $5k-$25k at the moment (estimation calculated on 08/26/2026).

Applying the patch 5365f012451fce2453f13a568dcb72ea534c1e4d is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion