CVE-2026-72319

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. This vulnerability occurs when the system processes Internet Control Message Protocol (ICMP) errors originating from network tunnels. Specifically, after stripping outer packet headers, the IPVS component fails to ensure that the inner IP headers are correctly positioned in the packet buffer's headroom. This improper handling of network packet headers could lead to incorrect packet processing, potentially resulting in a denial of service (DoS) or other forms of network instability.

Red Hat has rated this vulnerability as Important because an unauthenticated remote attacker could leverage crafted tunnel ICMP packets to trigger a kernel crash or memory corruption. In default Red Hat Enterprise Linux installations, the IPVS kernel module is not loaded, significantly limiting exposure to environments explicitly configured for IP Virtual Server load balancing. Systems not utilizing IPVS encapsulated routing or tunneling are not at risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the IP Virtual Server kernel module from loading if IPVS load balancing services are not required:

1. Create a configuration file to disable module loading:

echo "install ip_vs /bin/true" > /etc/modprobe.d/ip_vs.conf

2. If the module is already loaded, remove it:

modprobe -r ip_vs

Caveats: Disabling this module will disrupt systems actively utilizing IPVS for network load balancing, clustering (such as Keepalived), or container ingress proxies. If the module is currently in use and cannot be unloaded with modprobe, a system restart will be required for the configuration to take effect.