CVE-2026-74669: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74669 Overview

CVE-2026-74669 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw resides in ip_vs_in_icmp(), which rebases a socket buffer (skb) from an outer ICMP packet to the quoted original request before passing it to icmp_send(). After the rebase, IPCB(skb)->opt still describes the outer IPv4 header, leaving stale option metadata attached to the inner packet.

A crafted timestamp option in the outer IPv4 header produces an offset that points into the quoted transport header. When __ip_options_echo() processes this stale offset, it treats an attacker-influenced byte as an option length and copies it into fixed-size option storage on the __icmp_send() stack. The result is a stack out-of-bounds write reachable from the network.

Critical Impact
Remote attackers can trigger a stack out-of-bounds write in the kernel by sending crafted ICMP traffic to IPVS-enabled Linux hosts, enabling denial of service and potential kernel memory corruption.

Affected Products

Linux kernel builds with IPVS (CONFIG_IP_VS) enabled
Load balancers, Kubernetes nodes, and container hosts using IPVS-based service routing
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-22 - CVE-2026-74669 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74669

Vulnerability Analysis

The vulnerability is a stack out-of-bounds write [CWE-787] in the Linux kernel IPVS ICMP handling path. ip_vs_in_icmp() receives ICMP error messages that quote an original request packet. To notify the original sender, IPVS rebases the skb so the network header points at the quoted inner IPv4 header, then calls icmp_send() to emit a corresponding ICMP response.

The rebase operation resets the network header pointer but does not clear the IP control block (IPCB) option metadata. IPCB(skb)->opt continues to describe options parsed from the outer header, including the byte offset of any timestamp option. When __icmp_send() later invokes __ip_options_echo() to reflect IP options into the outgoing packet, it uses that stale offset against the new (inner) header contents.

Root Cause

The root cause is inconsistent packet metadata after header rebasing. The option offset stored in IPCB(skb)->opt references the outer header layout, but the skb data now begins at the quoted inner header. __ip_options_echo() reads whatever byte lies at the stale offset and treats it as an option length field, then copies that many bytes into a fixed-size buffer allocated on the kernel stack inside __icmp_send(). The fix clears the stale option metadata after resetting the network header while preserving other control-block fields, such as the ingress interface used by the ICMP response path.

Attack Vector

An unauthenticated remote attacker sends an ICMP error message toward an IPVS director. The outer IPv4 header carries a timestamp option positioned so that the resulting offset lands inside the quoted transport header of the inner packet. The attacker controls the bytes of the quoted transport header, which lets them influence the length value that __ip_options_echo() will consume. The subsequent copy overruns the fixed option storage on the __icmp_send() stack.

The vulnerability is reachable across the network without authentication or user interaction on any host that processes IPVS traffic. Refer to the Linux kernel stable commit 384b4da and the Linux kernel stable commit 37c61b3 for the patch source and full technical detail.

Detection Methods for CVE-2026-74669

Indicators of Compromise

Unexpected kernel stack traces referencing __ip_options_echo, __icmp_send, or ip_vs_in_icmp in dmesg or journalctl -k.
Kernel oops, panic, or KASAN out-of-bounds write reports on hosts running IPVS.
Bursts of inbound ICMP error packets carrying IPv4 timestamp options directed at load balancers or Kubernetes nodes.

Detection Strategies

Enable KASAN on test kernels and replay captured ICMP traffic to surface out-of-bounds writes in the IPVS ICMP path.
Deploy network intrusion detection signatures that flag ICMP error messages containing IPv4 timestamp options quoting non-standard transport headers.
Correlate kernel crash telemetry with IPVS service utilization to identify targeted hosts.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized analytics platform for anomaly review.
Track running kernel versions across the fleet and alert when hosts diverge from the patched baseline.
Monitor ICMP volume and option-usage patterns at network ingress points that front IPVS-based services.

How to Mitigate CVE-2026-74669

Immediate Actions Required

Inventory Linux hosts with CONFIG_IP_VS enabled, including Kubernetes worker nodes using kube-proxy in IPVS mode.
Apply the vendor kernel update that incorporates the upstream fix that clears stale IP option metadata after the ICMP rebase.
Restrict ingress ICMP at network perimeters where operationally feasible, prioritizing internet-exposed load balancers.

Patch Information

The fix clears IPCB(skb)->opt after resetting the network header in ip_vs_in_icmp(), while preserving other control-block fields such as the ingress interface. The change is available in the upstream stable tree across multiple branches. See the referenced commits: 37c61b3, 384b4da, 6f46fc4, 75eec93, 79ffa99, c9413b5, e0ba936, and ed246dd. Consume the fix through your distribution's kernel package once available.

Workarounds

Where IPVS is not required, switch kube-proxy to iptables mode or disable IPVS load balancing until the kernel is patched.
Drop inbound IPv4 packets containing the timestamp option at perimeter firewalls to reduce exposure to crafted triggers.
Rate-limit ICMP error messages destined for IPVS directors to reduce the practical attack surface.

bash

# Verify installed kernel and IPVS status before and after patching
uname -r
lsmod | grep -E '^ip_vs'
# Prefer distribution package manager to apply the fixed kernel
# Example (Debian/Ubuntu):
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
# Example (RHEL/CentOS/Rocky):
sudo dnf update kernel
# Reboot into the patched kernel
sudo systemctl reboot