External risk intelligence

Linux Kernel IPVS Stack Out-of-Bounds Write.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74669

This vulnerability exists in the Linux kernel IPVS (IP Virtual Server) component. While IPVS is commonly used in load balancers and network gateways that face the internet, it typically requires specific configuration to be exposed. The vulnerability relates to handling ICMP error packets in tunnel scenarios, which is a specialized network function rather than a default public-facing application.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This issue involves a flaw in the Linux kernel's handling of certain network traffic, specifically related to tunnel ICMP errors. While the technical details concern how IP options are managed after packet rebasing, the high-level implication is a potential for unauthorized access or manipulation of systems. The main concern is confirming relevance and exposure within our specific environment.

Kernel flaw affects network traffic handling.
Critical flaw could allow unauthorized access.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets that trigger an error in the IPVS component of the Linux kernel. This error handling process involves re-basing a network buffer, and if the original packet contained specific IPv4 options, the system may incorrectly interpret these options after the re-base. This misinterpretation can lead to writing data outside of designated memory areas, potentially allowing an attacker to control program execution or corrupt data.

No specific access required.
Triggers during ICMP error handling.
Leads to memory corruption and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's IP Virtual Server (IPVS) component could allow an attacker to overwrite kernel memory. This may occur when processing specific types of ICMP error messages in tunnel configurations, potentially leading to system instability or other unintended behavior. The advisory does not indicate that personal or sensitive user data is directly exposed.

Kernel memory.
Processing ICMP errors in tunnels.
System instability or unintended behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's IPVS component likely falls under the purview of the infrastructure or platform teams responsible for network services and kernel management. The initial step is to identify all systems running the affected kernel version and determine their exposure and criticality, especially those involved in network routing or load balancing, to prioritize remediation efforts.

Infrastructure or Platform Teams own resolution.
Verify reachability and business criticality first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel IPVS component?

IP Virtual Server (IPVS) is a transport-layer load balancing component integrated directly into the Linux kernel. It allows administrators to build highly scalable and high-performance network services by distributing incoming traffic across a cluster of backend servers. Because it operates within the kernel, it is a foundational piece of technology for many network gateways and routing infrastructures.

What is the memory vulnerability in CVE-2026-74669?

This is a stack out-of-bounds write flaw. When the kernel processes certain ICMP error messages, it re-bases data from an outer packet to an original request. If the outer packet contains specific IPv4 timestamp options, the kernel incorrectly calculates memory offsets. This causes the system to write data into an invalid area of the stack memory, potentially corrupting kernel operations.

How can an attacker trigger this CVE-2026-74669 vulnerability?

An attacker triggers this by sending a specially crafted network packet that forces the IPVS component to handle an ICMP error in a tunnel configuration. The issue specifically occurs when these ICMP packets contain stale IPv4 option metadata. Standard, well-formed network traffic that does not involve these specific tunnel-based ICMP error processing routines will not trigger the bug.

Does my network setup put me at risk for CVE-2026-74669?

Halo Surface Signal indicates the risk is 'Possible' for systems running IPVS, especially those acting as internet-facing load balancers or gateways. While the component is powerful, it is not always active by default. You should check if your infrastructure utilizes IPVS for tunneling or complex network routing, as these specific configurations are the primary focus for potential exposure.

How should I begin responding to this Linux kernel issue?

Your infrastructure and platform teams should start by auditing your environment to locate all systems running the affected Linux kernel with IPVS enabled. Focus your assessment on devices that handle network traffic or load balancing functions. Once identified, categorize these systems by their network accessibility to prioritize which nodes require kernel updates or configuration changes first.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.