CVE-2026-74747 Overview
CVE-2026-74747 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw exists in the handling of embedded IP headers within ICMP packets processed by ip_vs_nat_icmp(). A local process can modify the Internet Header Length (ihl) field after skb_ensure_writable() returns, causing subsequent reads to reference memory beyond the validated bounds. The resulting out-of-bounds access can be triggered by an unprivileged local user and impacts confidentiality, integrity, and availability of the kernel.
Critical Impact
Local attackers can trigger kernel out-of-bounds access in the IPVS ICMP NAT path, leading to kernel memory corruption or denial of service.
Affected Products
- Linux kernel (mainline) with IPVS enabled
- Stable kernel branches prior to the fix commits 5365f01245 and d93660df4d
- Distributions shipping vulnerable IPVS-enabled kernels
Discovery Timeline
- 2026-08-26 - CVE-2026-74747 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74747
Vulnerability Analysis
The vulnerability resides in the IPVS ICMP NAT translation path. When IPVS handles an ICMP error message, it must inspect the embedded IP header (cih) that describes the original triggering packet. While the outer IP header is pulled into the socket buffer (skb) head, the embedded headers may live in skb fragments. The code reads these embedded headers and, after calling skb_ensure_writable(), calls ip_send_check(cih) to recompute the checksum.
Between the initial read and the checksum computation, a local process can alter the embedded ihl field. If the modified ihl is larger than the value originally validated, ip_send_check() will read past the boundaries of the validated header region. The kernel then performs an out-of-bounds read against memory adjacent to the header buffer.
This is classified as an [Out-of-Bounds Read] / [Out-of-Bounds Write] class defect (CWE-125/CWE-787 family) caused by a time-of-check to time-of-use (TOCTOU) style race on the ihl field.
Root Cause
The root cause is missing revalidation of the embedded IP header length after it becomes writable. The IPVS code trusted that the ihl field observed during initial parsing would remain unchanged when accessed later. Because the value can be mutated by a concurrent local process, the header length used by ip_send_check() is unverified and may exceed the actual pulled length.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker crafts network traffic and concurrent write operations that race against the IPVS ICMP NAT processing to modify the embedded ihl value between validation and use. See the upstream fix commits 5365f012451fce2453f13a568dcb72ea534c1e4d and d93660df4dd1d116f608ada4a29a80a5d6f0a6ed for the exact code path.
No public proof-of-concept code is available. The vulnerability is described in prose only; see the linked commits for the corrective patch.
Detection Methods for CVE-2026-74747
Indicators of Compromise
- Unexpected kernel warnings, BUG:, or KASAN out-of-bounds reports referencing ip_vs_nat_icmp or ip_send_check
- Kernel panics or IPVS module crashes on hosts running load balancers with ICMP traffic
- Local processes with elevated CAP_NET_ADMIN or namespace access performing unusual skb manipulation
Detection Strategies
- Enable KASAN on test kernels to catch out-of-bounds accesses in the IPVS path during fuzzing
- Monitor dmesg and journalctl -k for stack traces containing ip_vs_nat_icmp symbols
- Audit installed kernel package versions against distribution advisories referencing the fix commits
Monitoring Recommendations
- Ship kernel logs to a central SIEM and alert on IPVS-related oops or KASAN messages
- Track loaded kernel modules and flag hosts running ip_vs on outdated kernel builds
- Correlate local process activity with kernel crash timestamps to identify race exploitation attempts
How to Mitigate CVE-2026-74747
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 5365f01245 and d93660df4d
- Inventory hosts using IPVS (lsmod | grep ip_vs) and prioritize patching load balancers and Kubernetes nodes
- Restrict local account access on IPVS-enabled hosts until patches are deployed
Patch Information
The fix adds a check that drops the packet if the ihl field has changed between the initial read and the writable stage. Patches are available in the mainline Linux kernel via kernel.org commit 5365f012451f and kernel.org commit d93660df4dd1. Consult your Linux distribution vendor for backported stable kernel releases.
Workarounds
- Unload the ip_vs module on systems that do not require IPVS: modprobe -r ip_vs
- Block or rate-limit inbound ICMP to IPVS virtual services where operationally acceptable
- Reduce local attack surface by removing unprivileged shell access on load balancer hosts
# Verify running kernel and IPVS module status
uname -r
lsmod | grep ip_vs
# Remove IPVS module if not required
sudo modprobe -r ip_vs
# Apply distribution kernel updates (example: Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
