# CVE-2026-74747: ipvs: revalidate ihl to prevent out-of-bounds access

CVE-2026-74747 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-74747, released September 4, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-74747
- Priority: High
- CVSS: 7.8 (Moderate)
- EPSS: 0.0014
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 26, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-74747

## Description

In the Linux kernel, the following vulnerability has been resolved:  ipvs: revalidate ihl to prevent out-of-bounds access  While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.  One such place reported by Sashiko is ip_vs_nat_icmp() where local process can change the ihl field and after skb_ensure_writable() we can see larger value which is a problem for the ip_send_check(cih) calls.  Add check to drop the packet if the ihl field is changed.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-74747](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74747.md) | Sep 4, 2026 |
| Linux | linux Debian 14 | 7.1.10-1 | [DEBIAN-CVE-2026-74747](https://patchblox.com/security/data/fix/linux/debian-cve-2026-74747.md) | Sep 4, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.