CVE-2026-74724: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
In the Linux kernel, the following vulnerability has been resolved:
ipvs: avoid out-of-bounds write in ipvsnaticmp
Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ipvsnaticmp where we can write after the validated area.
Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header.
Modify some IPv4 header checks by reading the ihl field only once.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
The description identifies a local attacker as the threat actor. Exploitation involves modifying a packet while it is being processed by IPVS.
What condition leads to the out-of-bounds write?
The issue arises when IPv4 header IHL is read multiple times while the packet can be modified, causing validation to no longer match the header length later used by ip_vs_nat_icmp. This can result in writing beyond the validated area.
What does the fix change?
The fix reads the IPv4 IHL field only once in the affected checks and uses the validated ciph->len value as the offset to the embedded transport header in ip_vs_nat_icmp.