CVE-2026-74747

A moderate severity flaw was found in the Linux kernel's IP Virtual Server (IPVS) implementation shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. In ip_vs_nat_icmp(), a local process can modify the embedded IP header's ihl (header length) field after the initial header validation; once skb_ensure_writable() relinearizes the packet, the changed ihl value is used by the ip_send_check() call, which can access memory beyond the validated embedded header bounds. The verified impact is a denial of service, such as system instability or a kernel crash, with no demonstrated confidentiality or integrity impact. Red Hat therefore rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the CVEORG score of 7.8 (Important) that assumes high confidentiality and integrity impact. The affected Red Hat Enterprise Linux kernel and kernel-rt streams and Red Hat In-Vehicle OS kernels are marked AFFECTED with a deferred resolution: because the flaw is of moderate severity and its impact is limited to local denial of service, the fix has been deferred to a future update rather than shipped as an immediate erratum, leaving a residual risk that a local attacker able to influence traffic on IPVS ICMP NAT paths could crash the system. The upstream fix drops packets whose ihl value changed after validation.