CVE-2026-74724 - ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Brief
CVE ID : CVE-2026-74724
Published : Aug. 22, 2026, 4:16 p. m.
- 4 hours, 54 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area.
Fix it by providing ciph argument just like it is done for IPv6 and use ciph-len as offset to the embedded transport header.
Modify some IPv4 header checks by reading the ihl field only once.