EUVD-2026-66577
GHSA-769p-7f5g-9f2g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description (local process manipulates ihl); PR:L because any unprivileged local user can trigger it; full C/I/A impact reflects kernel memory corruption consequences.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipvs: revalidate ihl to prevent out-of-bounds access
While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.
One such place reported by Sashiko is ip_vs_nat_icmp() where local process can change the ihl field and after skb_ensure_writable() we can see larger value which is a problem for the ip_send_check(cih) calls.
Add check to drop the packet if the ihl field is changed.
AnalysisAI
Out-of-bounds memory access in the Linux kernel's IPVS subsystem allows a low-privileged local process to trigger kernel memory corruption via ip_vs_nat_icmp(). The flaw arises because the embedded IP header length field (ihl) is not revalidated after skb_ensure_writable() is called on ICMP packets processed through IPVS NAT, enabling a local process to supply a larger ihl value than was originally validated, causing ip_send_check() to access memory beyond intended bounds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target system has the ip_vs (IPVS) kernel module loaded and actively configured in NAT mode - this is a non-default configuration on most general-purpose Linux systems but is the default kube-proxy mode in many Kubernetes deployments using IPVS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: any low-privileged local user who can manipulate network packets processed by an IPVS NAT instance can trigger kernel out-of-bounds access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged shell on a Linux server running Kubernetes with kube-proxy in IPVS NAT mode crafts an ICMP error packet with a manipulated ihl field and injects it into the processing path of ip_vs_nat_icmp(). After skb_ensure_writable() is called, the attacker's locally modified ihl value - now larger than the original - causes ip_send_check() to compute a checksum over memory beyond the intended header boundary, resulting in an out-of-bounds kernel memory read or write that can be leveraged to corrupt kernel data structures and escalate privileges to root. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.1.10 or 7.2, which contain the upstream patches at commits d93660df4dd1d116f608ada4a29a80a5d6f0a6ed and 5365f012451fce2453f13a568dcb72ea534c1e4d respectively (see https://git.kernel.org/stable/c/5365f012451fce2453f13a568dcb72ea534c1e4d and https://git.kernel.org/stable/c/d93660df4dd1d116f608ada4a29a80a5d6f0a6ed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Linux systems running IPVS in NAT mode and document their production criticality; request the latest kernel security patch from your Linux distributor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today