GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74724 (GCVE-0-2026-74724)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
Title
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Summary
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area. Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header. Modify some IPv4 header checks by reading the ihl field only once.
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3b8f79af0e98f27b932b0b416e9c52b692d31ff9 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3c779b258c9c3c3567af68d4f45c2f751f35bd0e (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < be65fa324640c7a95e30b146159a2be5cc73f22e (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a69a4b3fff5814d079beff9a1e9d369994b2ed47 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 243d0187ec4c3837b9b0004f18d1068e46115760 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 646922a0379496154e8c8faca4f8e2fd9100cacc (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_core.c",
            "net/netfilter/ipvs/ip_vs_xmit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b8f79af0e98f27b932b0b416e9c52b692d31ff9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3c779b258c9c3c3567af68d4f45c2f751f35bd0e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "be65fa324640c7a95e30b146159a2be5cc73f22e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a69a4b3fff5814d079beff9a1e9d369994b2ed47",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "243d0187ec4c3837b9b0004f18d1068e46115760",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "646922a0379496154e8c8faca4f8e2fd9100cacc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_vs.h",
            "net/netfilter/ipvs/ip_vs_core.c",
            "net/netfilter/ipvs/ip_vs_xmit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: avoid out-of-bounds write in ip_vs_nat_icmp\n\nSashiko warns that local attacker can modify the packet\nwhile it is processed by IPVS. Some places read the\nIP ihl field multiple times which can cause out-of-bounds\naccess. One such place is ip_vs_nat_icmp where we\ncan write after the validated area.\n\nFix it by providing ciph argument just like it is done for\nIPv6 and use ciph-\u003elen as offset to the embedded transport\nheader.\n\nModify some IPv4 header checks by reading the ihl field\nonly once."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB write in ip_vs_nat_icmp() requires a local process to change the embedded IPv4 ihl in skb frags between ip_vs_fill_iph_skb_icmp() validation and the NAT write; remote-only ICMP to IPVS netfilter hooks cannot perform that TOCTOU without local access to the packet buffer.\nAC:L - A local attacker controls both sides of the race by concurrently injecting ICMP errors with TCP/UDP/SCTP payloads matching an IPVS NAT connection and modifying the embedded header ihl in skb frags during softirq processing; no victim-specific state or uncontrollable heap layout is required.\nPR:L - Triggering requires a local account able to race skb frag modification (e.g., via raw/packet sockets with CAP_NET_RAW, obtainable in a user namespace) against IPVS ICMP NAT handling on a host where IPVS is already configured; no init-namespace root is needed.\nUI:N - No victim user interaction is required; exploitation is driven entirely by attacker-controlled local packet injection and concurrent frag modification while IPVS processes ICMP errors on NAT-mode connections through LOCAL_IN, LOCAL_OUT, or FORWARD hooks.\nS:U - The out-of-bounds write corrupts kernel skb memory on the IPVS load-balancer host within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Writing TCP/UDP/SCTP port fields and running ip_send_check() using a re-read inflated ihl corrupts skb data beyond the validated region; out-of-bounds kernel memory corruption is exploitable for information disclosure and heap layout control.\nI:H - The bug is an out-of-bounds write of 16-bit port values (and checksum updates over an attacker-inflated header length) past skb_ensure_writable()\u0027s bound, enabling adjacent kernel memory corruption and potential control-flow hijacking on internet-facing IPVS NAT nodes.\nA:H - Corrupting skb header memory beyond the ensured writable area can cause kernel oops or panic during ICMP NAT mangling; a local attacker can repeatedly trigger the race on kube-proxy IPVS nodes and hardware load balancers running IPVS NAT mode."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:04.705Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47"
        },
        {
          "url": "https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760"
        },
        {
          "url": "https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc"
        }
      ],
      "title": "ipvs: avoid out-of-bounds write in ip_vs_nat_icmp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74724",
    "datePublished": "2026-08-22T15:33:15.832Z",
    "dateReserved": "2026-08-15T05:44:03.929Z",
    "dateUpdated": "2026-08-25T05:42:04.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74724",
      "date": "2026-09-16",
      "epss": "0.00123",
      "percentile": "0.02384"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:49:35.000Z",
      "cve": "CVE-2026-74724",
      "id": "msrc_CVE-2026-74724",
      "initial_release_date": "2026-08-24T01:06:55.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipvs: avoid out-of-bounds write in ip_vs_nat_icmp",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74724.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74724\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:47.450\",\"lastModified\":\"2026-08-25T06:18:58.390\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipvs: avoid out-of-bounds write in ip_vs_nat_icmp\\n\\nSashiko warns that local attacker can modify the packet\\nwhile it is processed by IPVS. Some places read the\\nIP ihl field multiple times which can cause out-of-bounds\\naccess. One such place is ip_vs_nat_icmp where we\\ncan write after the validated area.\\n\\nFix it by providing ciph argument just like it is done for\\nIPv6 and use ciph-\u003elen as offset to the embedded transport\\nheader.\\n\\nModify some IPv4 header checks by reading the ihl field\\nonly once.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/ip_vs.h\",\"net/netfilter/ipvs/ip_vs_core.c\",\"net/netfilter/ipvs/ip_vs_xmit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3b8f79af0e98f27b932b0b416e9c52b692d31ff9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"3c779b258c9c3c3567af68d4f45c2f751f35bd0e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"be65fa324640c7a95e30b146159a2be5cc73f22e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"a69a4b3fff5814d079beff9a1e9d369994b2ed47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"243d0187ec4c3837b9b0004f18d1068e46115760\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\"lessThan\":\"646922a0379496154e8c8faca4f8e2fd9100cacc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/ip_vs.h\",\"net/netfilter/ipvs/ip_vs_core.c\",\"net/netfilter/ipvs/ip_vs_xmit.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:56:11+00:00",
      "cve": "CVE-2026-74724",
      "id": "CVE-2026-74724",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74724.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:15:43Z",
      "cve": "CVE-2026-74724",
      "id": "CVE-2026-74724",
      "initial_release_date": "2026-08-23T00:03:53Z",
      "product_status:known_affected": "357",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74724",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74724.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…