CVE-2026-74669

The flaw resides in the ipvs implementation of the Linux kernel. When an ICMP error packet is rebased to the original request packet, the skb's network header is reset but the IPv4 option metadata in the control block is not cleared. A timestamp option in the stale outer header can then persist, and the __ip_options_echo routine interprets data at that offset as an option length, copying it into a fixed‑size buffer on the stack and producing an out‑of‑bounds write. This stack corruption allows an attacker to execute arbitrary code at kernel mode, a classic buffer overflow (CWE‑787).

Any Linux kernel that contains the ipvs module and has not yet incorporated the recent patch is affected. The vulnerability is present in the default ipvs implementation shipped with the kernel, regardless of distribution. Specific version ranges are not listed, so all builds that have included the unpatched ipvs code are vulnerable until a kernel version containing the fix is deployed.

The CVSS score of 9.8 indicates a critical impact, while the EPSS score of less than 1 % suggests a low probability of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to craft a malformed ICMP error packet that triggers the rebase path in ipvs. The stack out‑of‑bounds write can lead to arbitrary code execution in kernel mode, providing an attacker with full control over the affected host. In practice, the attack vector is inferred to involve sending such a packet from a remote host through the network.