Out-of-bounds write in Linux kernel - CVE-2026-74670

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the IPVS estimator logic in net/netfilter/ipvs/ip_vs_est.c when processing temporary estimators during network namespace teardown after IPVS is disabled. A local user can trigger estimator enqueue operations in this state to cause a denial of service.

The issue occurs when the initial calculation phase exits without installing positive chain and tick limits, allowing the estimator thread to continue with zero limit values.

Affected software

How to mitigate CVE-2026-74670

External References

• https://git.kernel.org/stable/c/2335dedc1922dfa889ca1f9f70370924e8e79a08
• https://git.kernel.org/stable/c/558f67f1340f803a346ecd14a69c49653111c5f4
• https://git.kernel.org/stable/c/d5122a2b2601145975d387006e517c56896e310e
• https://git.kernel.org/stable/c/de98dc5ef94b83bbb444c670c253ea02ca0f5e43
• https://git.kernel.org/stable/c/e7f34f29b330265d456943bf0b984dcecfcef9af

Related Security Bulletins

• Out-of-bounds write in Linux kernel netfilter ipvs
• Debian update for linux