CVE-2026-72020 (GCVE-0-2026-72020)
Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-10-19 21:19
VLAI
EPSS
VEX
Title
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in
ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn
object with kmem_cache_alloc(). The function then initializes many
fields explicitly, but only resets in_seq.delta and out_seq.delta in the
two struct ip_vs_seq members.
That leaves init_seq and previous_delta uninitialized. This is normally
harmless while the corresponding IP_VS_CONN_F_IN_SEQ or
IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync
message, however, ip_vs_proc_conn() preserves those flags from
IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with
SEQ flags set but with the rest of in_seq/out_seq still containing stale
slab data.
When a packet for such a connection is later handled by an IPVS
application helper, vs_fix_seq() and vs_fix_ack_seq() use
previous_delta and init_seq to rewrite TCP sequence numbers. A malformed
sync message can therefore make forwarded packets carry stale slab bytes
in their TCP seq/ack numbers, and can also corrupt the forwarded TCP
flow.
Reset both struct ip_vs_seq members completely before publishing the
connection. This matches the existing "reset struct ip_vs_seq" comment
and keeps the sequence-adjustment gates inactive unless valid sequence
data is installed later.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:50 UTC
CWE
- CWE-457 - Use of Uninitialized Variable
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
9a05475cebdd6341884b5901e53870be26e65158 , < 3bf9a260188b2a5449cbddc032a749ab433fe328
(git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 6378c5cb360eb1750f88839d7c3613ea92ac1816 (git) Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 32c299e28b8eea6cbbd23b97dc61401e9ef9c445 (git) Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 9e36602cbec552286f7e691cfd366525c565ee74 (git) Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < d0eed7177e822cab83141e5c44b2aa345c7fd379 (git) Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 83fb4c2c5344f02eac929f66de3c9d1adfcde04c (git) Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 6335ab62d5fc9ed875279238233fba3462c168f5 (git) Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 2975324d164c552b028632f107b567302863b7f6 (git) |
guessed | |
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.97 , ≤ 6.12.* (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:50:08.361059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:23.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "9e36602cbec552286f7e691cfd366525c565ee74",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "2975324d164c552b028632f107b567302863b7f6",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:39:30.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"
},
{
"url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"
},
{
"url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"
},
{
"url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"
},
{
"url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"
},
{
"url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"
},
{
"url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"
},
{
"url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"
}
],
"title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72020",
"datePublished": "2026-08-15T05:51:46.675Z",
"dateReserved": "2026-08-09T03:40:39.900Z",
"dateUpdated": "2026-10-19T21:19:23.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-72020",
"date": "2026-10-20",
"epss": "0.00714",
"percentile": "0.52867"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "9e36602cbec552286f7e691cfd366525c565ee74",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "2975324d164c552b028632f107b567302863b7f6",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."
}
],
"id": "CVE-2026-72020",
"lastModified": "2026-10-19T22:17:22.243",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-72020",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:50:08.361059Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-15T06:21:00.920",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-457"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-17T17:00:03+00:00",
"cve": "CVE-2026-72020",
"id": "CVE-2026-72020",
"initial_release_date": "2026-08-15T00:00:00+00:00",
"product_status:known_affected": "274",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72020.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:50:08.361059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:50:09.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "9e36602cbec552286f7e691cfd366525c565ee74",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "2975324d164c552b028632f107b567302863b7f6",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:39:30.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"
},
{
"url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"
},
{
"url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"
},
{
"url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"
},
{
"url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"
},
{
"url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"
},
{
"url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"
},
{
"url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"
}
],
"title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72020",
"datePublished": "2026-08-15T05:51:46.675Z",
"dateReserved": "2026-08-09T03:40:39.900Z",
"dateUpdated": "2026-10-19T21:19:23.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.