ipvs: ensure inner headers in ICMP errors are in headroom

Summary

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskb_pull() we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom for functions like ipv4_update_pmtu(), icmp_send() and IP_VS_DBG(). Also, add more checks for the length of the inner headers.

Timeline

1. Aug 15, 2026, 5:55 AM UTCCVE published
2. Oct 16, 2026, 6:46 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 16, 2026, 6:55 PM UTCRecord last updated

Affected versions

• Linux Linux

  From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in 19657b3a17b774ae4e2f2635b5ae8638c9344a40; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in dac813101914c21219ac221a60a31a11bc90e7ec; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in dd22f74a09e25ca298ced0a3763ef353242cb78d; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in 9bc9b95aee2b2e3f1301a16a67ee504960402875; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in a735f9964a3d9ed97daf9b08507f8b5bcafe6326; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in 8f48cfe657409fb5c7ba0521b14da6d47546d9cf; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in 92185d6f7819bc558939ae83de7b1abe90e3b5c2; From f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e · fixed in 3f7a535ff0fa627a0132803e4c2f903ceffcbc1c

• Linux Linux

  3.7

• KernelLinux

  From 3.7.0 · fixed in 5.10.261; From 5.11.0 · fixed in 5.15.212; From 5.16.0 · fixed in 6.1.178; From 6.2.0 · fixed in 6.6.145; From 6.7.0 · fixed in 6.12.97; From 6.13.0 · fixed in 6.18.40; From 6.19.0 · fixed in 7.1.5

References 8