The Linux kernel IPVS component had a vulnerability (CVE-2026-74724) where multiple reads of the IPv4 header length (ihl) field could lead to out-of-bounds memory access and write in the ip_vs_nat_icmp function. This issue arises because the code did not consistently use the ciph argument and its length for offset calculations, causing writes beyond the validated packet area. The fix involved passing the ciph argument similarly to IPv6 handling and adjusting header checks to read the ihl field once, preventing out-of-bounds writes.

A local attacker could exploit this vulnerability to modify packets during IPVS processing, potentially leading to memory corruption. The exact consequences depend on the attack context but could include denial of service or other unpredictable behavior due to out-of-bounds writes.

The vulnerability has been resolved in the Linux kernel by the described code changes. No specific patch links are provided here, so users should consult official Linux kernel advisories or update to the latest kernel versions where this fix is included. Since this is not a cloud service, remediation requires applying the official kernel update containing the fix.