Linux Kernel CVE-2026-74669

Requires the target host to be running as a Linux IPVS/LVS director with virtual services configured, in practice using tunnel (IPIP) mode, and to process an ICMP error message that IPVS rebases to the inner quoted original request. The attacker must supply an IPv4 timestamp option in the outer header so that IPCB(skb)->opt carries a non-zero, now-stale option offset after the rebase, causing __ip_options_echo() to read a byte from the quoted transport header as an option length. Limiting factors: exploitation is confined to hosts with the ip_vs module loaded and tunnel virtual services active (non-default for general-purpose systems), depends on triggering the specific ICMP-error/quoted-packet code path, and requires crafting the timestamp option correctly - so despite CVSS PR:N/UI:N the realistic attack surface is limited to IPVS load-balancer deployments rather than arbitrary Linux hosts.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8) is the auto-generated Linux-CNA maximum and overstates real-world ease of exploitation. The bug is only reachable on hosts explicitly configured as IPVS/LVS directors handling tunneled virtual services and processing ICMP errors - a niche deployment, not a default configuration - and it requires crafting an IPv4 timestamp option plus triggering the quoted-packet ICMP path, which is why an assessed AC:H is more honest than AC:L. Corroborating signals point to lower urgency: EPSS is 0.22% (13th percentile), there is no CISA KEV listing, and no public PoC. It is a genuine memory-safety issue with a plausible path to denial of service (kernel crash) and a theoretical path to privilege escalation via stack corruption, so it should be patched, but it is a targeted/config-dependent kernel issue rather than a widespread internet-facing 9.8. Conflict to note explicitly: CVSS advertises trivial network exploitation (AC:L/PR:N), yet the description implies a specific IPVS tunnel deployment and option-crafting requirement - verify whether IPVS tunnel mode is actually in use before prioritizing as critical.

An attacker who can reach a Linux IPVS director configured for tunnel-mode virtual services sends traffic that provokes an ICMP error carrying a crafted outer IPv4 timestamp option; when IPVS rebases the ICMP packet to the quoted request and calls icmp_send(), the stale option offset causes __ip_options_echo() to copy an attacker-controlled length into a fixed stack buffer, writing out of bounds and crashing or potentially corrupting the kernel stack. No authentication is required and no PoC is currently public, but the attack requires the specific IPVS tunnel configuration and the ability to steer an ICMP error into the director's quoted-packet path.