EUVD-2026-64356
GHSA-8jr6-vjx9-8g96
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remotely triggerable without auth (AV:N/PR:N) but only on IPVS tunnel directors and needs a crafted timestamp option, so AC:H; kernel stack OOB write gives high C/I/A potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset that points into the quoted transport header after the rebase. __ip_options_echo() treats a byte at that stale location as the option length and copies it into the fixed-size option storage on the __icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header. Keep the remaining control block fields, including the ingress interface used by the ICMP response path.
AnalysisAI
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target host to be running as a Linux IPVS/LVS director with virtual services configured, in practice using tunnel (IPIP) mode, and to process an ICMP error message that IPVS rebases to the inner quoted original request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) is the auto-generated Linux-CNA maximum and overstates real-world ease of exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a Linux IPVS director configured for tunnel-mode virtual services sends traffic that provokes an ICMP error carrying a crafted outer IPv4 timestamp option; when IPVS rebases the ICMP packet to the quoted request and calls icmp_send(), the stale option offset causes __ip_options_echo() to copy an attacker-controlled length into a fixed stack buffer, writing out of bounds and crashing or potentially corrupting the kernel stack. No authentication is required and no PoC is currently public, but the attack requires the specific IPVS tunnel configuration and the ability to steer an ICMP error into the director's quoted-packet path. |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel for your branch - 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9 or 7.2 (or later) - using your distribution's backported package once available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit production Linux systems to identify IPVS usage (verify with: lsmod | grep ip_vs) and obtain current kernel versions from your systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today