CVE-2026-74724: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-74724 Overview

CVE-2026-74724 is an out-of-bounds write vulnerability in the Linux kernel's IP Virtual Server (IPVS) subsystem. The flaw resides in the ip_vs_nat_icmp function, which processes ICMP packets during network address translation. A local attacker can modify a packet while IPVS processes it, exploiting a time-of-check to time-of-use condition. Multiple reads of the IPv4 header ihl field allow writes past the validated area of the packet buffer. The vulnerability affects Linux kernel builds that ship IPVS with NAT support enabled.

Critical Impact
A local attacker with the ability to inject or modify packets processed by IPVS can trigger memory corruption in kernel space, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel (upstream) with IPVS NAT support compiled in
Distributions shipping affected stable kernel branches prior to the referenced patch commits
Systems using IPVS load balancing with ICMP NAT translation

Discovery Timeline

2026-08-22 - CVE-2026-74724 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74724

Vulnerability Analysis

The vulnerability arises in the IPVS NAT ICMP handler when translating embedded IP packets inside ICMP error messages. The function ip_vs_nat_icmp reads the IPv4 Internet Header Length (ihl) field from the embedded packet multiple times. Between reads, a local attacker with sufficient access to the packet buffer can modify the ihl value, creating a discrepancy between the validated length and the length used when writing the translated header. This TOCTOU condition permits kernel writes beyond the boundary that was checked, corrupting adjacent memory in the socket buffer or neighboring kernel structures.

Root Cause

The root cause is unsafe repeated access to attacker-influenced packet header fields without caching the validated value. IPVS validated the header length once, then re-read ihl when computing the offset to the embedded transport header. Because the packet buffer remains mutable during processing, the second read could return a different value than the first, invalidating the earlier bounds check. The upstream fix passes a ciph argument mirroring the IPv6 path and uses ciph->len as the offset. Additional IPv4 header checks were updated to read ihl only once and reuse the cached value.

Attack Vector

Exploitation requires local access with the ability to influence packet contents while they traverse the IPVS NAT ICMP code path. The attacker races kernel processing to modify the ihl field between the validation and the write. Successful exploitation writes attacker-controlled or arbitrary data into kernel memory adjacent to the packet, which can be leveraged for kernel memory corruption, escalation to root, or a kernel panic. No user interaction is required, and the scope remains unchanged relative to the exploiting process context.

No public proof-of-concept is available at the time of publication. See the upstream fix commit a69a4b3f for the exact code changes.

Detection Methods for CVE-2026-74724

Indicators of Compromise

Unexpected kernel oops or panics referencing ip_vs_nat_icmp or IPVS subsystem functions in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds writes originating from the IPVS NAT ICMP path.
Anomalous ICMP traffic volumes on hosts running IPVS load balancers, particularly malformed ICMP error packets with inconsistent embedded IHL values.

Detection Strategies

Audit kernel versions across the fleet against the fixed commit hashes listed in the upstream patches (243d0187, a69a4b3f).
Enable KASAN in test or staging kernels to catch out-of-bounds writes triggered by fuzzing IPVS with crafted ICMP payloads.
Correlate host telemetry showing kernel warnings with local user activity to identify potential exploitation attempts.

Monitoring Recommendations

Forward /var/log/kern.log and journald kernel events to a centralized logging platform and alert on IPVS-related stack traces.
Monitor for privilege escalation indicators such as unexpected uid=0 shells spawned by low-privileged accounts on hosts running IPVS.
Track IPVS statistics via ipvsadm -Ln --stats for abnormal ICMP counters on load-balancer nodes.

How to Mitigate CVE-2026-74724

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that incorporates the upstream IPVS fix.
Inventory hosts running IPVS with NAT mode and prioritize patching load balancer nodes and Kubernetes kube-proxy IPVS deployments.
Restrict local shell access on IPVS hosts to trusted administrators to reduce the local attack surface.

Patch Information

The upstream Linux kernel maintainers merged fixes across multiple stable branches. Refer to the following commits: 243d0187, 3b8f79af, 3c779b25, 646922a0, a69a4b3f, and be65fa32. Consult your distribution's security advisory for the corresponding package version.

Workarounds

Disable IPVS NAT mode where feasible, or switch to direct routing (DR) or tunneling (TUN) forwarding methods that do not exercise the vulnerable ICMP NAT code path.
Unload the ip_vs kernel module on hosts that do not require IPVS: modprobe -r ip_vs.
Limit local user access and enforce least privilege using SELinux or AppArmor policies to reduce the pool of principals capable of triggering the race.

bash

# Verify running kernel version and IPVS module status
uname -r
lsmod | grep ip_vs

# Remove IPVS module where not required
sudo modprobe -r ip_vs

# Prevent IPVS from loading at boot
echo 'blacklist ip_vs' | sudo tee /etc/modprobe.d/blacklist-ipvs.conf