{"id":"CVE-2026-74670","state":"PUBLISHED","title":"ipvs: stop estimator after disabled calc phase","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: stop estimator after disabled calc phase\n\nIPVS estimator kthread 0 starts with zeroed chain and tick limits until\nits initial calculation phase completes. If network namespace teardown\nclears ipvs->enable during that phase, ip_vs_est_calc_phase() can return\nwithout installing positive limits.\n\nThe kthread can then continue into its main loop and drain\nest_temp_list with zero chain_max, tick_max and est_max_count values.\nEach enqueue consumes one available tick row, but est_count never\nreaches the zero est_max_count value. After all rows are consumed, the\nrow lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes\npast the ticks and tick_len arrays.\n\nExit kthread 0 after the calculation phase if the kthread is stopping or\nIPVS has been disabled. That keeps temporary estimators from being\ndrained after the limits failed to initialize.\n\nEstimator kthreads can now self-exit before teardown or reload stops\nkd->task. Keep an extra task reference after creation and release it\nwith kthread_stop_put(), so kd->task remains valid until the stop paths\nconsume that reference.","publishedAt":"2026-08-22T15:32:40.850Z","updatedAt":"2026-08-25T05:41:25.343Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"d5122a2b2601145975d387006e517c56896e310e","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"de98dc5ef94b83bbb444c670c253ea02ca0f5e43","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"e7f34f29b330265d456943bf0b984dcecfcef9af","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"2335dedc1922dfa889ca1f9f70370924e8e79a08","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"558f67f1340f803a346ecd14a69c49653111c5f4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_est.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.152","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_est.c"]}],"references":["https://git.kernel.org/stable/c/d5122a2b2601145975d387006e517c56896e310e","https://git.kernel.org/stable/c/de98dc5ef94b83bbb444c670c253ea02ca0f5e43","https://git.kernel.org/stable/c/e7f34f29b330265d456943bf0b984dcecfcef9af","https://git.kernel.org/stable/c/2335dedc1922dfa889ca1f9f70370924e8e79a08","https://git.kernel.org/stable/c/558f67f1340f803a346ecd14a69c49653111c5f4"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74670.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74670","state":"PUBLISHED","datePublished":"2026-08-22T15:32:40.850Z","dateUpdated":"2026-08-25T05:41:25.343Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.925Z"},"containers":{"cna":{"title":"ipvs: stop estimator after disabled calc phase","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: stop estimator after disabled calc phase\n\nIPVS estimator kthread 0 starts with zeroed chain and tick limits until\nits initial calculation phase completes. If network namespace teardown\nclears ipvs->enable during that phase, ip_vs_est_calc_phase() can return\nwithout installing positive limits.\n\nThe kthread can then continue into its main loop and drain\nest_temp_list with zero chain_max, tick_max and est_max_count values.\nEach enqueue consumes one available tick row, but est_count never\nreaches the zero est_max_count value. After all rows are consumed, the\nrow lookup returns IPVS_EST_NTICKS and ip_vs_enqueue_estimator() writes\npast the ticks and tick_len arrays.\n\nExit kthread 0 after the calculation phase if the kthread is stopping or\nIPVS has been disabled. That keeps temporary estimators from being\ndrained after the limits failed to initialize.\n\nEstimator kthreads can now self-exit before teardown or reload stops\nkd->task. Keep an extra task reference after creation and release it\nwith kthread_stop_put(), so kd->task remains valid until the stop paths\nconsume that reference."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"d5122a2b2601145975d387006e517c56896e310e","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"de98dc5ef94b83bbb444c670c253ea02ca0f5e43","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"e7f34f29b330265d456943bf0b984dcecfcef9af","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"2335dedc1922dfa889ca1f9f70370924e8e79a08","versionType":"git"},{"version":"705dd34440812735ece298eb5bc153fde9544d42","status":"affected","lessThan":"558f67f1340f803a346ecd14a69c49653111c5f4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_est.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.152","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.104","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.45","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.9","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_est.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d5122a2b2601145975d387006e517c56896e310e"},{"url":"https://git.kernel.org/stable/c/de98dc5ef94b83bbb444c670c253ea02ca0f5e43"},{"url":"https://git.kernel.org/stable/c/e7f34f29b330265d456943bf0b984dcecfcef9af"},{"url":"https://git.kernel.org/stable/c/2335dedc1922dfa889ca1f9f70370924e8e79a08"},{"url":"https://git.kernel.org/stable/c/558f67f1340f803a346ecd14a69c49653111c5f4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local IPVS configuration via netlink or setsockopt (GENL_ADMIN_PERM/CAP_NET_ADMIN); the bug is in estimator kthread management during namespace teardown, not in remote packet handling.\nAC:L - The attacker controls both sides of the race by creating a network namespace, adding many IPVS services to populate est_temp_list, and tearing down the namespace during kthread 0's calc phase.\nPR:L - Triggering IPVS service creation and namespace teardown requires CAP_NET_ADMIN, which unprivileged users can obtain in user+network namespaces via unshare on systems with unprivileged user namespaces enabled.\nUI:N - No victim interaction is required; an attacker can script IPVS service creation and namespace destruction without any action from another user or administrator.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same kernel security boundary; impact is local privilege escalation or denial of service, not a cross-boundary escape.\nC:H - Out-of-bounds writes past ticks[] and tick_len[] corrupt adjacent heap metadata and kernel structures, providing a memory corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - Writing past the fixed-size ticks[] and tick_len[] arrays enables heap corruption that can overwrite function pointers or adjacent objects, supporting arbitrary kernel write and potential code execution.\nA:H - Heap corruption from unbounded index writes in ip_vs_enqueue_estimator() can cause kernel oops, panic, or hang when processing estimators after failed calc-phase initialization."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-25T05:41:25.343Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.152"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.18.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}