# CVE-2026-74724 — Linux

> As of 2026-08-22, CVE-2026-74724 is a vulnerability in Linux, EPSS 0.2% (10.7th percentile). No Threadlinqs-tracked threat campaign has been attributed to CVE-2026-74724 as of 2026-08-22; the identifier is re-checked against the Threadlinqs threat corpus on every daily ingest.

**Last updated:** 2026-08-22

## What is CVE-2026-74724?

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such place is ip_vs_nat_icmp where we can write after the validated area. Fix it by providing ciph argument just like it is done for IPv6 and use ciph->len as offset to the embedded transport header. Modify some IPv4 header checks by reading the ihl field only once.

1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 44 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 0.2% probability of exploitation in the next 30 days, higher than 10.7% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 0.4/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2026-08-22

## Is CVE-2026-74724 being exploited?

It currently carries a trending score of 32 in the Threadlinqs vulnerability feed.

## Affected products and versions

- [Linux](https://intel.threadlinqs.com/vendors/linux): Linux

## How to fix CVE-2026-74724

No vendor patch reference has been recorded for CVE-2026-74724 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2026-74724

No threat campaign in the Threadlinqs corpus currently references CVE-2026-74724, in its CVE list or as an indicator. The linkage is recomputed from the live corpus on every daily ingest, so this section fills in as soon as a tracked campaign cites the identifier.

## Sources

Enriched from CVE.org, FIRST EPSS. Last verified by Threadlinqs on 2026-08-24.

**Other references**

- [git.kernel.org](https://git.kernel.org/stable/c/3b8f79af0e98f27b932b0b416e9c52b692d31ff9)
- [git.kernel.org (3c779b258c9c3c3567af68d4f45c2f751f35bd0e)](https://git.kernel.org/stable/c/3c779b258c9c3c3567af68d4f45c2f751f35bd0e)
- [git.kernel.org (be65fa324640c7a95e30b146159a2be5cc73f22e)](https://git.kernel.org/stable/c/be65fa324640c7a95e30b146159a2be5cc73f22e)
- [git.kernel.org (a69a4b3fff5814d079beff9a1e9d369994b2ed47)](https://git.kernel.org/stable/c/a69a4b3fff5814d079beff9a1e9d369994b2ed47)
- [git.kernel.org (243d0187ec4c3837b9b0004f18d1068e46115760)](https://git.kernel.org/stable/c/243d0187ec4c3837b9b0004f18d1068e46115760)

_Showing 5 of 6 recorded references._

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-74724
Full detection coverage and IOCs for threats exploiting CVE-2026-74724 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp