Linux Kernel EUVD-2026-64411

Exploitation requires all of the following conditions: (1) the ip_vs kernel module must be loaded and IPVS must be actively processing traffic - IPVS is not loaded by default and must be explicitly configured (e.g., for LVS, HAProxy with kernel IPVS, or Kubernetes kube-proxy in IPVS mode); (2) the attacker must hold a low-privileged local account (PR:L per CVSS) on the affected host - remote-only access is insufficient; (3) the attacker must be able to send or influence ICMP packets that IPVS will process via its NAT path (ip_vs_nat_icmp). Limiting factors: systems without IPVS configured (the majority of Linux deployments) are entirely unexposed; network-only attacker access with no local shell is not sufficient; exploiting the race requires precisely timed packet manipulation between kernel reads, adding practical reliability constraints beyond what AC:L implies.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high potential impact but a local-only attack vector requiring at minimum a low-privileged account. The TOCTOU nature of the race condition introduces practical exploitation difficulty that the AC:L assignment may understate - successful exploitation depends on timing packet manipulation between kernel reads, which adds real-world reliability challenges. The EPSS score of 0.21% (11th percentile) is consistent with this: low observed exploitation probability, no confirmed active exploitation (CVE absent from CISA KEV), and no known public POC. Even so, the C:H/I:H/A:H triad means successful exploitation yields full kernel compromise, making this a high-priority patch for multi-tenant environments. Even a mid-sized municipal IT team in gdynia operating IPVS-based load balancers should treat this as urgent given the broad kernel version exposure spanning from 2.6.12 through current stable branches. The combination of low EPSS and high CVSS is typical for kernel subsystem memory corruption bugs that require specific local conditions (IPVS loaded and active) but carry catastrophic impact once those conditions are met.

A local attacker with a standard unprivileged account on a Linux server running IPVS (e.g., a Kubernetes node with kube-proxy in IPVS mode) sends or manipulates ICMP packets timed to race between multiple kernel reads of the IP ihl field during IPVS NAT processing. By controlling the ihl value between the validation check and the subsequent read used to compute the transport header offset, the attacker triggers a write beyond the validated memory region, potentially overwriting kernel data structures to escalate to root. No public proof-of-concept has been identified at time of analysis.