Linux Kernel CVE-2026-45917

Exploitation requires local access to the target system with at least low-privilege kernel interaction capability (CVSS PR:L), confirmed by AV:L in the CVSS vector. The affected system must have the IPVS kernel module loaded and actively managing destination routes (ip_vs module present and in use). A network device shutdown event must occur concurrently with IPVS destination cache population - this race window limits reliable exploitation. Systems not using IPVS (e.g., standard servers without LVS, keepalived, or Kubernetes IPVS kube-proxy) are not affected even if running a vulnerable kernel version. Remote unauthenticated exploitation is not possible. The race condition window is narrow and timing-dependent, requiring either repeated attempts or privileged control over network device lifecycle.

Real-world risk is low despite the 'High' availability sub-score. The CVSS vector (AV:L/AC:L/PR:L) confirms this requires local authenticated access with at least low privileges, ruling out remote exploitation. EPSS at 0.02% (5th percentile) corroborates minimal exploitation interest from the threat intelligence community. There is no CISA KEV listing and no public proof-of-concept identified. The impact is a leaked kernel device reference rather than immediate memory corruption, meaning exploitation requires the additional step of triggering resource exhaustion or a kernel panic via the leaked reference - making this a multi-condition reliability issue more than a direct attack primitive. Patch availability across multiple stable branches (6.12.75, 6.18.14, 6.19.4, 7.0) suggests the upstream community has addressed this systematically. The race window is narrow (device shutdown timing), which in practice limits reliable reproduction. This is a genuine kernel defect warranting patching in routine maintenance cycles but does not warrant emergency remediation.

A local attacker with low-privileged access to a system running IPVS-based load balancing (e.g., a Kubernetes node using kube-proxy in IPVS mode, or an LVS appliance) triggers repeated network device shutdown events while IPVS is actively caching destination routes, racing the notifier handler to inject a stale cached entry referencing the closing device. Over time or with repeated triggering, the leaked device references accumulate, potentially exhausting kernel memory structures or causing a kernel panic when the device is finally fully torn down. No public proof-of-concept exists, and reproducing the race requires precise timing control.