---
id: CVE-2026-74724
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

  Sashiko warns that local attacker can modify the packet
  while it is processed by IPVS
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

  Sashiko warns that local attacker can modify the packet
  while it is processed by IPVS. Some places read the
  IP ihl fi…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74724'
references:
  - url: 'https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/646922a0379496154e8c8faca4f8e2fd9100cacc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00123
epssPercentile: 0.01848
ingestedAt: '2026-10-14T13:30:58.548Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

Sashiko warns that local attacker can modify the packet
while it is processed by IPVS. Some places read the
IP ihl field multiple times which can cause out-of-bounds
access. One such place is ip_vs_nat_icmp where we
can write after the validated area.

Fix it by providing ciph argument just like it is done for
IPv6 and use ciph->len as offset to the embedded transport
header.

Modify some IPv4 header checks by reading the ihl field
only once.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.