Preface: Today, I want to walk you through a critical vulnerability rooted deep within the Linux kernel networking stack: CVE-2026-74724, and discuss how it impacts modern cloud-native environments.
Background: As we know, when a Kubernetes cluster scales, the default iptables backend suffers from severe performance degradation due to its O(n) sequential rule matching. To handle thousands of services efficiently, production-grade clusters typically switch to IPVS mode, as illustrated on the right side of the slide. IPVS utilizes a kernel-level Hash Table to achieve an 0(1) constant-time lookup, ensuring massive throughput and low latency. However, this exact performance-critical module was recently discovered to contain a dangerous memory boundary vulnerability.
Vulnerability details: The flaw is located within the ip_vs_core[.]c and ip_vs_nat[.]c source files.
If you look at Box 5, the legacy kernel implementation handled embedded ICMP error packets using a dangerous direct pointer cast: (struct iphdr *)(icmph + 1).
This implementation blindly assumes that the network packet buffer inside the kernel is always mapped to a continuous, linear memory space. A local attacker can intentionally craft non-linear, fragmented network packets. By changing packet lengths mid-flight while the IPVS core evaluates the ihl (Internet Header Length) field, they can trigger a TOCTOU (Time-of-Check to Time-of-Use) race condition, ultimately resulting in an Out-of-Bounds Write exploit.
My opinion: While the official mainline kernel has patched this vulnerability by locking the number of ihl reads, from a software developer’s perspective, we should adopt a more defensive programming approach.
As shown in points 6 and 7, when developing or refactoring Netfilter modules, we should completely abandon direct pointer casting and instead use the kernel’s standard safe function `skb_header_pointer`. It automatically detects memory contiguity and safely returns `NF_DROP` when the boundary length is insufficient.
Finally, point 8 is particularly important: if `skb_header_pointer` is used to copy data to a stacked copy, any subsequent field modifications must be accompanied by `skb_store_bits()` to safely write the changes back to the actual kit buffer. This is the ultimate solution that balances performance and memory security.
Official announcement: Please refer to the link for details –