Linux Kernel EUVD-2026-66577

Exploitation requires that the target system has the ip_vs (IPVS) kernel module loaded and actively configured in NAT mode - this is a non-default configuration on most general-purpose Linux systems but is the default kube-proxy mode in many Kubernetes deployments using IPVS. The attacker must have local code execution with at least low-privilege credentials (PR:L per CVSS vector) on the target host. The specific trigger is the processing of an ICMP error packet by ip_vs_nat_icmp() where the attacker can influence the embedded IP header's ihl field between the initial validation and the skb_ensure_writable() call. Exploitation is limited by: (1) requirement for local shell access - no remote unauthenticated path exists; (2) IPVS NAT mode must be actively configured and handling traffic; (3) the attacker must be able to inject or influence packets reaching the IPVS NAT code path. Systems using IPVS in DR (Direct Routing) or TUN mode are not exposed to this specific function.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: any low-privileged local user who can manipulate network packets processed by an IPVS NAT instance can trigger kernel out-of-bounds access. The high C/I/A impact scores reflect the realistic consequence of kernel memory corruption - potential kernel crash (denial of service) or privilege escalation to root. The key limiting factor is the attack vector: AV:L means this is not remotely exploitable in the traditional sense; the attacker must already have local code execution. No CISA KEV listing exists and no public exploit has been identified, placing this at a lower urgency tier despite the high CVSS. EPSS data was not provided in source intelligence. Practical risk is elevated in containerized or multi-tenant Linux environments (VPS providers, Kubernetes nodes, shared HPC clusters) where IPVS NAT is in use - common in kube-proxy's IPVS mode - and where untrusted local processes are present. The attack complexity is genuinely low once the prerequisite conditions are met, so patching should be prioritized on affected IPVS-enabled systems despite the absence of known active exploitation.

An attacker with a low-privileged shell on a Linux server running Kubernetes with kube-proxy in IPVS NAT mode crafts an ICMP error packet with a manipulated ihl field and injects it into the processing path of ip_vs_nat_icmp(). After skb_ensure_writable() is called, the attacker's locally modified ihl value - now larger than the original - causes ip_send_check() to compute a checksum over memory beyond the intended header boundary, resulting in an out-of-bounds kernel memory read or write that can be leveraged to corrupt kernel data structures and escalate privileges to root. No public proof-of-concept exploit has been identified at time of analysis.