CVE-2026-74724

A flaw was found in the Linux kernel's IPVS (IP Virtual Server) component. A local attacker can exploit this vulnerability by manipulating packets processed by IPVS, specifically within the ip_vs_nat_icmp function. This manipulation can lead to an out-of-bounds write due to improper handling of the IP header length field. This allows the attacker to write data beyond the intended memory area, potentially corrupting data or leading to further system compromise.

This vulnerability is rated as Moderate severity because exploitation requires local access, high attack complexity to alter packet headers concurrently during processing, and an environment running active IPVS load balancing. By default, the IPVS kernel modules are not loaded or configured on standard Red Hat Enterprise Linux installations. Systems remain unaffected unless IPVS-based load balancing services or container networking configurations relying on IPVS are explicitly enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.