CVE-2026-72020

Received Received - Intake

Heap Memory Corruption in Linux Kernel IPVS

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn object with kmem_cache_alloc(). The function then initializes many fields explicitly, but only resets in_seq.delta and out_seq.delta in the two struct ip_vs_seq members. That leaves init_seq and previous_delta uninitialized. This is normally harmless while the corresponding IP_VS_CONN_F_IN_SEQ or IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync message, however, ip_vs_proc_conn() preserves those flags from IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with SEQ flags set but with the rest of in_seq/out_seq still containing stale slab data. When a packet for such a connection is later handled by an IPVS application helper, vs_fix_seq() and vs_fix_ack_seq() use previous_delta and init_seq to rewrite TCP sequence numbers. A malformed sync message can therefore make forwarded packets carry stale slab bytes in their TCP seq/ack numbers, and can also corrupt the forwarded TCP flow. Reset both struct ip_vs_seq members completely before publishing the connection. This matches the existing "reset struct ip_vs_seq" comment and keeps the sequence-adjustment gates inactive unless valid sequence data is installed later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72020

EUVD

EUVD-2026-58978

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's IPVS (IP Virtual Server) component. It involves incomplete initialization of sequence number structures in new IPVS connections. When a connection is created, only some fields are reset, leaving others with stale data from memory. This can lead to corrupted TCP sequence numbers in forwarded packets if the connection is later handled by an IPVS application helper.

Detection Guidance

This vulnerability affects the Linux kernel's IPVS (IP Virtual Server) connection handling. Detection requires checking kernel logs for IPVS-related errors or inspecting kernel memory for uninitialized sequence data. Commands like 'dmesg | grep ipvs' or 'journalctl -k | grep ipvs' may reveal issues. However, specific detection commands are not provided in the given context.

Impact Analysis

An attacker could exploit this to corrupt TCP sequence numbers in network traffic passing through the affected system. This might cause packet corruption, connection resets, or other unexpected behavior in network services relying on IPVS for load balancing or forwarding.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel issue affecting IPVS sequence handling. Compliance risks would only arise if exploitation led to data integrity breaches, which is not described in the provided context.

Mitigation Strategies

Apply the kernel patch referenced in the vulnerability description (commit 9a05475cebdd). Update your Linux kernel to a version that includes this fix. If immediate patching is not possible, disable IPVS or restrict sync message processing until the patch is applied.

Hi! I’m here to help you understand CVE-2026-72020. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70