CVE-2026-74724
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area. Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header. Modify some IPv4 header checks by reading the ihl field only once.
INFO
Published Date :
Aug. 22, 2026, 4:16 p.m.
Last Modified :
Aug. 22, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Read the IP ihl field only once.
- Use ciph->len as offset to embedded transport header.
- Apply the provided fix for IPVS ICMP NAT.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74724.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74724 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74724
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74724 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74724 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '3b8f79af0e98f27b932b0b416e9c52b692d31ff9', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '3c779b258c9c3c3567af68d4f45c2f751f35bd0e', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'be65fa324640c7a95e30b146159a2be5cc73f22e', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': 'a69a4b3fff5814d079beff9a1e9d369994b2ed47', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '243d0187ec4c3837b9b0004f18d1068e46115760', 'versionType': 'git'}, {'status': 'affected', 'version': '1da177e4c3f41524e886b7f1b8a0c1fc7321cac2', 'lessThan': '646922a0379496154e8c8faca4f8e2fd9100cacc', 'versionType': 'git'}], 'programFiles': ['include/net/ip_vs.h', 'net/netfilter/ipvs/ip_vs_core.c', 'net/netfilter/ipvs/ip_vs_xmit.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['include/net/ip_vs.h', 'net/netfilter/ipvs/ip_vs_core.c', 'net/netfilter/ipvs/ip_vs_xmit.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area. Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header. Modify some IPv4 header checks by reading the ihl field only once. Added Reference https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760 Added Reference https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9 Added Reference https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e Added Reference https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc Added Reference https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47 Added Reference https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e