CVE-2026-72319

ipvs: ensure inner headers in ICMP errors are in headroom

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: ensure inner headers in ICMP errors are in headroom

Sashiko points out that after stripping the outer headers with pskb_pull() we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom for functions like ipv4_update_pmtu(), icmp_send() and IP_VS_DBG().

Also, add more checks for the length of the inner headers.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 19657b3a17b774ae4e2f2635b5ae8638c9344a40Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before dac813101914c21219ac221a60a31a11bc90e7ecAffected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before dd22f74a09e25ca298ced0a3763ef353242cb78dAffected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 9bc9b95aee2b2e3f1301a16a67ee504960402875Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before a735f9964a3d9ed97daf9b08507f8b5bcafe6326Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 8f48cfe657409fb5c7ba0521b14da6d47546d9cfAffected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 92185d6f7819bc558939ae83de7b1abe90e3b5c2Affected f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 3f7a535ff0fa627a0132803e4c2f903ceffcbc1cAffected
LinuxLinux	3.7Affected before 3.7Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 19657b3a17b774ae4e2f2635b5ae8638c9344a40Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before dac813101914c21219ac221a60a31a11bc90e7ecAffected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before dd22f74a09e25ca298ced0a3763ef353242cb78dAffected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 9bc9b95aee2b2e3f1301a16a67ee504960402875Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before a735f9964a3d9ed97daf9b08507f8b5bcafe6326Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 8f48cfe657409fb5c7ba0521b14da6d47546d9cfAffected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 92185d6f7819bc558939ae83de7b1abe90e3b5c2Affected
f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e to before 3f7a535ff0fa627a0132803e4c2f903ceffcbc1cAffected

LinuxLinux

3.7Affected
before 3.7Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.