Security readout for executives and security teams
Plain-English summary
A Linux IPVS networking flaw occurs when packet memory may be reallocated but code retains an IP-header reference that needs reloading. The record rates it 9.8, implying possible remote, unauthenticated, no-click impact. However, the bundle documents neither a demonstrated exploit nor the exact failure outcome, so practical risk depends on affected kernel code and IPVS use.
Executive priority
Treat this as an urgent, scope-first kernel remediation issue because the assigned score is critical and the stated attack vector is remote without authentication. Identify IPVS-dependent, untrusted-network-facing systems first, then promptly patch confirmed affected builds. Avoid declaring fleet-wide exposure until vendor package mapping resolves the ambiguous version list.
Technical view
__ip_vs_get_out_rt() invokes skb_ensure_writable(), which may reallocate skb->head. The fix reloads the IP-header reference afterward, implying the prior pointer could become stale. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No CWE, trigger details, or proven impact mechanism are supplied.
Likely exposure
Potentially exposed assets are Linux systems running affected kernel code where IPVS processes relevant traffic. The record lists affected entries from 4.10 through 7.2, including several stable-series versions, but does not define a clean version range. Confirm exposure through distribution package mapping or commit ancestry; do not rely on version-string comparison alone.
Exploitation context
The supplied record is not in KEV and provides no cited evidence of active exploitation or a public proof of concept. That does not establish absence of exploitation. The CVSS vector describes a network-reachable, low-complexity, unauthenticated, no-interaction scenario, but the bundle omits prerequisites and trigger details.
Researcher notes
The issue appears to involve an IP-header pointer becoming stale after skb head reallocation; this is inferred from the fix description. Eight stable references suggest fixes across multiple kernel branches. The bundle provides no CWE, reproducer, crash trace, exploitability analysis, or precise vulnerable commit range. Treat the CVSS impact claims as record metadata pending deeper vendor detail.
Mitigation direction
- Apply vendor-supported kernel updates containing the applicable cited stable fix.
- Prioritize IPVS hosts reachable from the Internet or untrusted networks.
- If updates are unavailable, obtain distribution guidance; the bundle specifies no alternative mitigation.
- Use normal kernel rollout controls and ensure systems boot the updated kernel.
Validation and detection
- Inventory Linux systems where IPVS is enabled or actively used.
- Record running kernel builds and map them to distribution advisories or cited commits.
- Verify the running kernel, not merely installed packages, contains the applicable fix.
- Monitor vendor advisories for clarified affected ranges and impact details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-68476 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4f2d1151421520d7ae16ca8d367d0ca09f5dfbd7CVE reference, Linux
- https://git.kernel.org/stable/c/657118cad620172dfd8f6ed5717fd75c0d1f7a5aCVE reference, Linux
- https://git.kernel.org/stable/c/a10f5080afbed242640f2984328de25f84557da1CVE reference, Linux
- https://git.kernel.org/stable/c/ac6ac3d35bfc0ade9d17d354c84e503a946ebdabCVE reference, Linux
- https://git.kernel.org/stable/c/e51687fc56c2e39ea6e9532925f1aabd4d529f61CVE reference, Linux
- https://git.kernel.org/stable/c/3fb7edd2018bb1ad0a68157383d9b9dac33dd645CVE reference, Linux
- https://git.kernel.org/stable/c/ad1e14710b360bda087ebf9fb82460eb5ef775deCVE reference, Linux
- https://git.kernel.org/stable/c/a2f57827bf7c695b8c72dc4511cae8e86582369dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.