Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access. One such place reported by Sashiko is ip_vs_nat_icmp() where local process can change the ihl field and after skb_ensure_writable() we can see larger value which is a problem for the ip_send_check(cih) calls. Add check to drop the packet if the ihl field is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:16:53.657Z",
  "pubdate": "2026-08-26T15:16:53.657Z",
  "executiveSummary": "A vulnerability exists within the Linux kernel IP Virtual Server (IPVS) module related to insufficient validation of the Internet Header Length (IHL) field in embedded IP headers.\nThis flaw allows an attacker to trigger an out-of-bounds (OOB) memory access by manipulating the IHL field after the packet data has been transitioned to a writable state via skb_ensure_writable().\nThe vulnerability resides specifically within the ip_vs_nat_icmp() function, which processes ICMP error messages associated with IPVS-handled traffic.\nSuccessful exploitation could result in kernel-level memory corruption or system instability, potentially leading to a denial-of-service (DoS) condition.\nThe vulnerability is reachable by local processes capable of modifying IP packet structures that subsequently undergo NAT processing by the IPVS subsystem.\nProper validation of packet headers after memory synchronization is required to ensure that header lengths remain consistent with actual buffer sizes.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of embedded IP headers during ICMP translation within the IPVS framework. In the context of Linux kernel networking, the skb_ensure_writable() function is utilized to ensure that the data segment of a socket buffer is located in linear memory, allowing for safe modifications to protocol headers.\nThe vulnerability specifically manifests in ip_vs_nat_icmp(), which attempts to process ICMP packets that contain an embedded (inner) IP header. While the kernel initially pulls the outer IP header into the skb head, it fails to account for potential modifications to the inner IP header's IHL field that may occur following a call to skb_ensure_writable().\nThe IHL field in an IPv4 header defines the number of 32-bit words in the header; if this value is manipulated by a malicious local process after the initial check but before the invocation of ip_send_check(cih), the kernel may operate on an incorrect header size. When ip_send_check(cih) attempts to perform a checksum verification, it references the IHL field to calculate the boundaries of the header.\nIf the IHL value has been artificially inflated, the function will perform reads beyond the intended boundaries of the packet data stored in the skb fragments. This leads to an out-of-bounds memory access. Because this processing happens within the kernel context, an attacker can leverage this discrepancy to read sensitive kernel memory or induce a kernel panic due to invalid memory access patterns.\nThe attack flow follows a structured path: first, an attacker constructs or intercepts an ICMP packet associated with an IPVS NAT connection. Second, the attacker ensures the packet is subject to processing by the affected ip_vs_nat_icmp() handler. Third, the attacker manipulates the IHL field in the inner header to exceed the actual allocated memory bounds. Finally, the kernel performs a write synchronization via skb_ensure_writable(), followed by a header check that reads the malicious IHL value, triggering the OOB memory access during the checksum calculation or subsequent header parsing."
}