CVE-2026-72020

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in

ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn

object with kmem_cache_alloc(). The function then initializes many

fields explicitly, but only resets in_seq.delta and out_seq.delta in the

two struct ip_vs_seq members.

That leaves init_seq and previous_delta uninitialized. This is normally

harmless while the corresponding IP_VS_CONN_F_IN_SEQ or

IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync

message, however, ip_vs_proc_conn() preserves those flags from

IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits

IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with

SEQ flags set but with the rest of in_seq/out_seq still containing stale

slab data.

When a packet for such a connection is later handled by an IPVS

application helper, vs_fix_se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References