Skip to main content

Linux Kernel CVE-2026-68476

| EUVDEUVD-2026-59098 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-3fqj-wv67-hq22
Information Disclosure Linux Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Remote/no-auth against an IPVS director (AV:N/PR:N) but requires IPVS enabled and a reallocation race (AC:H); stale-pointer read yields limited disclosure (C:L/I:L) with likely crash (A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:52 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:20 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 06:20 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reload ip header after head reallocation

__ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.

AnalysisAI

Memory-safety defect in the Linux kernel IPVS (IP Virtual Server) subsystem where __ip_vs_get_out_rt() calls skb_ensure_writable(), which can reallocate skb->head, leaving a stale IP-header pointer that is then dereferenced. Affected hosts are Linux systems acting as IPVS load balancers/directors; the flaw can lead to reads of freed/relocated packet memory (information disclosure) or kernel instability. No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); the upstream fix reloads the IP header after reallocation.

Technical ContextAI

IPVS is the in-kernel Layer-4 load balancer (Linux Virtual Server) used to distribute traffic across backend real servers. In the affected code path, __ip_vs_get_out_rt() invokes skb_ensure_writable() to make the socket buffer writable; this routine can reallocate skb->head to obtain a linear, writable region. Any pointer into the old buffer - specifically the previously-computed IP header pointer (iph) - becomes dangling after that reallocation. Using the stale pointer is a classic use-after-free/dangling-pointer class defect (CWE-416/CWE-825), even though the CVE record lists CWE as N/A. The fix re-derives the IP header from the (possibly relocated) skb after skb_ensure_writable() returns.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc4 (or your distribution's backported equivalent) via the stable commits at https://git.kernel.org/stable/c/e51687fc56c2e39ea6e9532925f1aabd4d529f61 and the related trees. Rebuild/reboot into the patched kernel following your normal maintenance window. As an interim compensating control on hosts that do not require load balancing, unload or blacklist the IPVS module (e.g. remove ip_vs from active use and prevent autoload), which fully removes the vulnerable code path but disables any LVS/IPVS-based load balancing - do not do this on production directors. Where IPVS must stay enabled, restrict which networks can send traffic through the director (upstream ACLs/firewalling) to limit exposure until the patched kernel is deployed. Confirm the running version with uname -r after reboot.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68476 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy