{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74724", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:15.832Z", "dateUpdated": "2026-08-25T05:42:04.705Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:42:04.705Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: avoid out-of-bounds write in ip_vs_nat_icmp\n\nSashiko warns that local attacker can modify the packet\nwhile it is processed by IPVS. Some places read the\nIP ihl field multiple times which can cause out-of-bounds\naccess. One such place is ip_vs_nat_icmp where we\ncan write after the validated area.\n\nFix it by providing ciph argument just like it is done for\nIPv6 and use ciph->len as offset to the embedded transport\nheader.\n\nModify some IPv4 header checks by reading the ihl field\nonly once."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The OOB write in ip_vs_nat_icmp() requires a local process to change the embedded IPv4 ihl in skb frags between ip_vs_fill_iph_skb_icmp() validation and the NAT write; remote-only ICMP to IPVS netfilter hooks cannot perform that TOCTOU without local access to the packet buffer.\nAC:L - A local attacker controls both sides of the race by concurrently injecting ICMP errors with TCP/UDP/SCTP payloads matching an IPVS NAT connection and modifying the embedded header ihl in skb frags during softirq processing; no victim-specific state or uncontrollable heap layout is required.\nPR:L - Triggering requires a local account able to race skb frag modification (e.g., via raw/packet sockets with CAP_NET_RAW, obtainable in a user namespace) against IPVS ICMP NAT handling on a host where IPVS is already configured; no init-namespace root is needed.\nUI:N - No victim user interaction is required; exploitation is driven entirely by attacker-controlled local packet injection and concurrent frag modification while IPVS processes ICMP errors on NAT-mode connections through LOCAL_IN, LOCAL_OUT, or FORWARD hooks.\nS:U - The out-of-bounds write corrupts kernel skb memory on the IPVS load-balancer host within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries into a separate security scope.\nC:H - Writing TCP/UDP/SCTP port fields and running ip_send_check() using a re-read inflated ihl corrupts skb data beyond the validated region; out-of-bounds kernel memory corruption is exploitable for information disclosure and heap layout control.\nI:H - The bug is an out-of-bounds write of 16-bit port values (and checksum updates over an attacker-inflated header length) past skb_ensure_writable()'s bound, enabling adjacent kernel memory corruption and potential control-flow hijacking on internet-facing IPVS NAT nodes.\nA:H - Corrupting skb header memory beyond the ensured writable area can cause kernel oops or panic during ICMP NAT mangling; a local attacker can repeatedly trigger the race on kube-proxy IPVS nodes and hardware load balancers running IPVS NAT mode."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/ip_vs.h", "net/netfilter/ipvs/ip_vs_core.c", "net/netfilter/ipvs/ip_vs_xmit.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3b8f79af0e98f27b932b0b416e9c52b692d31ff9", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3c779b258c9c3c3567af68d4f45c2f751f35bd0e", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "be65fa324640c7a95e30b146159a2be5cc73f22e", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "a69a4b3fff5814d079beff9a1e9d369994b2ed47", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "243d0187ec4c3837b9b0004f18d1068e46115760", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "646922a0379496154e8c8faca4f8e2fd9100cacc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/ip_vs.h", "net/netfilter/ipvs/ip_vs_core.c", "net/netfilter/ipvs/ip_vs_xmit.c"], "versions": [{"version": "2.6.12", "status": "affected"}, {"version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9"}, {"url": "https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e"}, {"url": "https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e"}, {"url": "https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47"}, {"url": "https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760"}, {"url": "https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc"}], "title": "ipvs: avoid out-of-bounds write in ip_vs_nat_icmp", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/ip_vs.h", "net/netfilter/ipvs/ip_vs_core.c", "net/netfilter/ipvs/ip_vs_xmit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3b8f79af0e98f27b932b0b416e9c52b692d31ff9", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "3c779b258c9c3c3567af68d4f45c2f751f35bd0e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "be65fa324640c7a95e30b146159a2be5cc73f22e", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "a69a4b3fff5814d079beff9a1e9d369994b2ed47", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "243d0187ec4c3837b9b0004f18d1068e46115760", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "646922a0379496154e8c8faca4f8e2fd9100cacc", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/ip_vs.h", "net/netfilter/ipvs/ip_vs_core.c", "net/netfilter/ipvs/ip_vs_xmit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"lessThan": "2.6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: avoid out-of-bounds write in ip_vs_nat_icmp\n\nSashiko warns that local attacker can modify the packet\nwhile it is processed by IPVS. Some places read the\nIP ihl field multiple times which can cause out-of-bounds\naccess. One such place is ip_vs_nat_icmp where we\ncan write after the validated area.\n\nFix it by providing ciph argument just like it is done for\nIPv6 and use ciph->len as offset to the embedded transport\nheader.\n\nModify some IPv4 header checks by reading the ihl field\nonly once."}], "id": "CVE-2026-74724", "lastModified": "2026-08-25T06:18:58.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:47.450", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp", "id": "2521481", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521481"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipvs: avoid out-of-bounds write in ip_vs_nat_icmp\nSashiko warns that local attacker can modify the packet\nwhile it is processed by IPVS. Some places read the\nIP ihl field multiple times which can cause out-of-bounds\naccess. One such place is ip_vs_nat_icmp where we\ncan write after the validated area.\nFix it by providing ciph argument just like it is done for\nIPv6 and use ciph->len as offset to the embedded transport\nheader.\nModify some IPv4 header checks by reading the ihl field\nonly once.", "A flaw was found in the Linux kernel's IPVS (IP Virtual Server) component. A local attacker can exploit this vulnerability by manipulating packets processed by IPVS, specifically within the `ip_vs_nat_icmp` function. This manipulation can lead to an out-of-bounds write due to improper handling of the IP header length field. This allows the attacker to write data beyond the intended memory area, potentially corrupting data or leading to further system compromise."], "name": "CVE-2026-74724", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74724\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74724\nhttps://lore.kernel.org/linux-cve-announce/2026082240-CVE-2026-74724-1dbc@gregkh/T"], "threat_severity": "Moderate"}