EUVD-2026-64411
GHSA-qcch-2r2r-xcw2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition on ihl reads requires precise packet timing, warranting AC:H over the vendor-assigned AC:L; all other metrics align with description.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area.
Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header.
Modify some IPv4 header checks by reading the ihl field only once.
AnalysisAI
Out-of-bounds write in the Linux kernel's IPVS subsystem (ip_vs_nat_icmp) allows a local attacker with low privileges to corrupt kernel memory by exploiting a TOCTOU race on the IP header length field (ihl), which is read multiple times during ICMP packet NAT processing. Affected systems include any Linux kernel from version 2.6.12 through the pre-patch range across multiple stable branches (fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions: (1) the `ip_vs` kernel module must be loaded and IPVS must be actively processing traffic - IPVS is not loaded by default and must be explicitly configured (e.g., for LVS, HAProxy with kernel IPVS, or Kubernetes kube-proxy in IPVS mode); (2) the attacker must hold a low-privileged local account (PR:L per CVSS) on the affected host - remote-only access is insufficient; (3) the attacker must be able to send or influence ICMP packets that IPVS will process via its NAT path (`ip_vs_nat_icmp`). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high potential impact but a local-only attack vector requiring at minimum a low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard unprivileged account on a Linux server running IPVS (e.g., a Kubernetes node with kube-proxy in IPVS mode) sends or manipulates ICMP packets timed to race between multiple kernel reads of the IP `ihl` field during IPVS NAT processing. By controlling the `ihl` value between the validation check and the subsequent read used to compute the transport header offset, the attacker triggers a write beyond the validated memory region, potentially overwriting kernel data structures to escalate to root. … |
| Remediation | The primary fix is to upgrade to a patched kernel version corresponding to the active stable branch: 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running IPVS (commonly used in network appliances, load balancers, and virtualization hosts) and catalog their current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today