CVE-2026-74670 Overview
CVE-2026-74670 affects the Linux kernel's IP Virtual Server (IPVS) subsystem. The vulnerability resides in the estimator kthread logic, where the initial calculation phase can be interrupted by a network namespace teardown that clears ipvs->enable. When this race occurs, the kthread proceeds into its main loop with zeroed chain_max, tick_max, and est_max_count limits.
The kthread drains est_temp_list without ever reaching the zero est_max_count threshold. Once all tick rows are consumed, ip_vs_enqueue_estimator() writes past the ticks and tick_len arrays, producing an out-of-bounds write in kernel memory.
Critical Impact
A local, low-privileged attacker who can trigger network namespace teardown during IPVS estimator initialization can corrupt kernel memory, leading to privilege escalation or denial of service.
Affected Products
- Linux kernel branches containing the IPVS estimator kthread logic prior to the fix commits
- Distributions shipping affected stable kernel trees referenced in the upstream advisory
- Systems using IPVS with network namespaces (containers, orchestrators)
Discovery Timeline
- 2026-08-22 - CVE-2026-74670 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74670
Vulnerability Analysis
The defect is a race between IPVS estimator kthread initialization and network namespace teardown. IPVS estimator kthread 0 begins with zeroed chain and tick limits. Those limits are only populated after ip_vs_est_calc_phase() completes its calibration pass.
If ipvs->enable is cleared during that phase, ip_vs_est_calc_phase() returns without installing positive limits. The kthread then enters its main loop with all zero thresholds. It continues draining the temporary estimator list because est_count can never equal a zero est_max_count.
Each enqueue consumes one tick row. When every row is exhausted, the row lookup returns IPVS_EST_NTICKS, and ip_vs_enqueue_estimator() writes beyond the bounds of the ticks and tick_len arrays. The result is a controllable kernel heap out-of-bounds write [CWE-787] with high confidentiality, integrity, and availability impact.
Root Cause
The root cause is missing state validation after the disabled calculation phase. The kthread does not check whether it is stopping or whether IPVS was disabled before proceeding to drain estimators. A secondary issue involves the lifetime of kd->task: the kthread can now self-exit before teardown or reload paths reference it.
Attack Vector
Exploitation requires local access and low privileges within a context that can create or destroy network namespaces containing IPVS state. An attacker races namespace teardown against IPVS estimator initialization to reach the vulnerable code path. The out-of-bounds write occurs in kernel memory adjacent to the estimator arrays and can be steered toward exploitable kernel structures.
No public proof-of-concept is available at this time, and the vulnerability is not listed in CISA KEV. Refer to the Kernel Git Commit e7f34f2 and companion commits for the exact code paths affected.
Detection Methods for CVE-2026-74670
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing ip_vs_enqueue_estimator or ip_vs_est_calc_phase in dmesg and /var/log/messages
- KASAN reports flagging out-of-bounds writes in the IPVS estimator arrays on instrumented kernels
- Repeated network namespace creation and teardown activity from unprivileged workloads coinciding with IPVS load
Detection Strategies
- Monitor kernel logs for stack traces involving IPVS estimator functions and correlate with container or namespace lifecycle events
- Deploy KASAN-enabled kernels in staging to catch the out-of-bounds write during fuzzing or CI runs
- Track loading of the ip_vs module and subsequent creation of virtual services within short-lived namespaces
Monitoring Recommendations
- Alert on kernel crash telemetry that references IPVS symbols across your fleet
- Audit workloads with CAP_NET_ADMIN or user-namespace privileges that interact with IPVS
- Feed kernel logs and container runtime events into a centralized data lake for correlation and retrospective hunting
How to Mitigate CVE-2026-74670
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits e7f34f2, d5122a2, 2335ded, 558f67f, and de98dc5 as soon as they are available in your distribution
- Restrict CAP_NET_ADMIN and unprivileged user namespace creation on multi-tenant hosts until patches are deployed
- Reboot systems after kernel update to ensure the fixed IPVS code is active
Patch Information
The fix exits estimator kthread 0 after the calculation phase when the kthread is stopping or IPVS has been disabled, preventing temporary estimators from being drained with uninitialized limits. It also retains an extra task reference after kthread creation and releases it with kthread_stop_put(), keeping kd->task valid until stop paths consume that reference. See the upstream fixes: Kernel Git Commit e7f34f2, Kernel Git Commit d5122a2, Kernel Git Commit 2335ded, Kernel Git Commit 558f67f, and Kernel Git Commit de98dc5.
Workarounds
- Blocklist the ip_vs module on hosts that do not require IPVS load balancing to eliminate the vulnerable code path
- Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 on distributions that expose this tunable
- Constrain container workloads with seccomp and Linux capability profiles that deny namespace and IPVS management syscalls
# Prevent the ip_vs module from loading on hosts that do not need it
echo 'install ip_vs /bin/true' | sudo tee /etc/modprobe.d/disable-ipvs.conf
sudo rmmod ip_vs 2>/dev/null || true
# Restrict unprivileged user namespace creation where supported
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
