CVE-2026-74747: ipvs: revalidate ihl to prevent out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved:
ipvs: revalidate ihl to prevent out-of-bounds access
While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.
One such place reported by Sashiko is ipvsnaticmp() where local process can change the ihl field and after skbensurewritable() we can see larger value which is a problem for the ipsendcheck(cih) calls.
Add check to drop the packet if the ihl field is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (ipvs)to a version that resolves this vulnerability.Patch ipvs: revalidate ihl to prevent out-of-bounds access - Configuration
Update the IPVS NAT ICMP path (ip_vs_nat_icmp()) to revalidate the outer/embedded IP header IHL after potential changes by the local process, preventing out-of-bounds access when computing/using values for ip_send_check(cih) and reading from skb frags.
ip_vs_nat_icmp() (IPVS in Linux kernel) IHL revalidation behavior = Revalidate the ihl field (and embedded headers) before using it to access skb frags / embedded headers to prevent out-of-bounds access
Event History
Frequently Asked Questions
What conditions are needed to trigger the issue?
The affected path is ip_vs_nat_icmp() in Linux IPVS processing. The issue occurs when a local process can modify an embedded IP header's IHL field after the header has been read from skb fragments and skb_ensure_writable() is called.
What is the impact of a successful trigger?
A changed IHL value can cause subsequent processing, including ip_send_check(cih), to access data out of bounds. The fix drops packets when the IHL field changes during this processing.
What mitigation is available if the fix cannot be deployed immediately?
The provided information identifies the problematic condition as local modification of the packet's embedded IHL field during IPVS ICMP NAT handling. No configuration workaround or temporary mitigation is specified.