CVE-2026-74669

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. When processing Internet Control Message Protocol (ICMP) errors for tunneled packets, the system can incorrectly use a stale IPv4 option offset. A remote attacker could exploit this by sending a specially crafted ICMP packet, leading to a stack out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.

This vulnerability is rated with an Important severity because a remote attacker can cause kernel stack memory corruption by sending malicious network packets, which can lead to a denial of service or potential code execution. In standard Red Hat Enterprise Linux installations, the IP Virtual Server (IPVS) kernel module is not loaded by default, limiting risk to systems configured as load balancers. Exploitation requires the host to actively handle encapsulated network flows and process ICMP error messages for tunneled sessions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ip_vs kernel module from loading. This can be achieved by creating a blacklist rule.

1. Unload the module if currently loaded: sudo modprobe -r ip_vs
2. Create a blacklist configuration file: echo "blacklist ip_vs" | sudo tee /etc/modprobe.d/disable-ip_vs.conf
3. Rebuild the initial RAM disk to ensure the module is not loaded at boot: sudo dracut -f A system reboot is required for the changes to take full effect. Disabling this module will prevent the use of IP Virtual Server (IPVS) functionality.