---
id: CVE-2026-74747
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipvs: revalidate ihl to prevent out-of-bounds access

  While the outer IP header is already pulled into the skb head,
  we must be careful and revalidate the embedded head…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipvs: revalidate ihl to prevent out-of-bounds access

  While the outer IP header is already pulled into the skb head,
  we must be careful and revalidate the embedded head…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    eb81c8e758f49e04391f77d9470a6232bb5f1c7a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5365f012451fce2453f13a568dcb72ea534c1e4d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d93660df4dd1d116f608ada4a29a80a5d6f0a6ed
  - Linux 2.6.12
published: '2026-08-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:49.550'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74747'
references:
  - url: 'https://git.kernel.org/stable/c/5365f012451fce2453f13a568dcb72ea534c1e4d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d93660df4dd1d116f608ada4a29a80a5d6f0a6ed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eb81c8e758f49e04391f77d9470a6232bb5f1c7a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.0535
ingestedAt: '2026-10-15T11:00:41.668Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipvs: revalidate ihl to prevent out-of-bounds access

While the outer IP header is already pulled into the skb head,
we must be careful and revalidate the embedded headers after
reading them from the skb frags to prevent out-of-bounds
access.

One such place reported by Sashiko is ip_vs_nat_icmp() where
local process can change the ihl field and after
skb_ensure_writable() we can see larger value which is a
problem for the ip_send_check(cih) calls.

Add check to drop the packet if the ihl field is changed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.