CVE-2026-74747: ipvs: revalidate ihl to prevent out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved:
ipvs: revalidate ihl to prevent out-of-bounds access
While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.
One such place reported by Sashiko is ipvsnaticmp() where local process can change the ihl field and after skbensurewritable() we can see larger value which is a problem for the ipsendcheck(cih) calls.
Add check to drop the packet if the ihl field is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.10 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In IPVS packet processing, revalidate the embedded IP header IHL after reading it from skb fragments and after skb_ensure_writable(); drop the packet if the IHL field has changed or would result in an out-of-bounds access.
Event History
Frequently Asked Questions
What conditions are needed to trigger the issue?
The affected path is ip_vs_nat_icmp() in Linux IPVS processing. The issue occurs when a local process can modify an embedded IP header's IHL field after the header has been read from skb fragments and skb_ensure_writable() is called.
What is the impact of a successful trigger?
A changed IHL value can cause subsequent processing, including ip_send_check(cih), to access data out of bounds. The fix drops packets when the IHL field changes during this processing.
What mitigation is available if the fix cannot be deployed immediately?
The provided information identifies the problematic condition as local modification of the packet's embedded IHL field during IPVS ICMP NAT handling. No configuration workaround or temporary mitigation is specified.