CVE-2026-74670

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. During the initial setup of the IPVS estimator, if the network namespace is removed, the estimator may continue operating with uninitialized limits. This can lead to an out-of-bounds write when processing network statistics, potentially causing a system crash or denial of service.

IPVS estimator kthread 0 can continue after the initial calculation phase even when IPVS has been disabled during network namespace teardown. In that state the estimator limits may remain zero, and draining est_temp_list can make ip_vs_enqueue_estimator write past the ticks and tick_len arrays. This is a local control plane trigger rather than a packet processing network trigger. For the CVSS the PR:L is used because a local user with access to an IPVS capable network namespace or delegated CAP_NET_ADMIN may be able to reach the vulnerable path. AC:H is used because the condition depends on a teardown timing window during the estimator calculation phase. Impact is at least local denial of service via kernel crash. In the paranoid score, the out of bounds write is treated as a plausible kernel memory corruption path with possible confidentiality, integrity, and availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.