CVE-2026-74747

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. A local attacker can manipulate the IP Header Length (ihl) field within network packets. This manipulation can lead to an out-of-bounds access when the kernel attempts to revalidate embedded headers, potentially causing system instability or a denial of service.

A moderate severity flaw was found in the Linux kernel's IP Virtual Server (IPVS) implementation shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. In ip_vs_nat_icmp(), a local process can modify the embedded IP header's ihl (header length) field after the initial header validation; once skb_ensure_writable() relinearizes the packet, the changed ihl value is used by the ip_send_check() call, which can access memory beyond the validated embedded header bounds. The verified impact is a denial of service, such as system instability or a kernel crash, with no demonstrated confidentiality or integrity impact. Red Hat therefore rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVEORG score of 7.8 (Important) that assumes high confidentiality and integrity impact. The affected Red Hat Enterprise Linux kernel and kernel-rt streams and Red Hat In-Vehicle OS kernels are marked AFFECTED with a deferred resolution: because the flaw is of moderate severity and its impact is limited to local denial of service, the fix has been deferred to a future update rather than shipped as an immediate erratum, leaving a residual risk that a local attacker able to influence traffic on IPVS ICMP NAT paths could crash the system. The upstream fix drops packets whose ihl value changed after validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.