CVE-2026-74747
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/08/2026
Last modified:
27/08/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ipvs: revalidate ihl to prevent out-of-bounds access<br />
<br />
While the outer IP header is already pulled into the skb head,<br />
we must be careful and revalidate the embedded headers after<br />
reading them from the skb frags to prevent out-of-bounds<br />
access.<br />
<br />
One such place reported by Sashiko is ip_vs_nat_icmp() where<br />
local process can change the ihl field and after<br />
skb_ensure_writable() we can see larger value which is a<br />
problem for the ip_send_check(cih) calls.<br />
<br />
Add check to drop the packet if the ihl field is changed.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH