CVE-2026-72020

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72020", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.900Z", "datePublished": "2026-08-15T05:51:46.675Z", "dateUpdated": "2026-10-19T21:19:23.243Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:39:30.496Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipvs/ip_vs_conn.c"], "versions": [{"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "9e36602cbec552286f7e691cfd366525c565ee74", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5", "status": "affected", "versionType": "git"}, {"version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "2975324d164c552b028632f107b567302863b7f6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/ipvs/ip_vs_conn.c"], "versions": [{"version": "3.10", "status": "affected"}, {"version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"}, {"url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"}, {"url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"}, {"url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"}, {"url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"}, {"url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"}, {"url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"}, {"url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"}], "title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72020", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:50:08.361059Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457 Use of Uninitialized Variable"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:19:23.243Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72020", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:50:08.361059Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-457", "description": "CWE-457 Use of Uninitialized Variable"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:50:09.406Z"}}], "cna": {"title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "9e36602cbec552286f7e691cfd366525c565ee74", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5", "versionType": "git"}, {"status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "lessThan": "2975324d164c552b028632f107b567302863b7f6", "versionType": "git"}], "programFiles": ["net/netfilter/ipvs/ip_vs_conn.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"status": "unaffected", "version": "0", "lessThan": "3.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/ipvs/ip_vs_conn.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"}, {"url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"}, {"url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"}, {"url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"}, {"url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"}, {"url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"}, {"url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"}, {"url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:39:30.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72020", "state": "PUBLISHED", "dateUpdated": "2026-10-19T21:19:23.243Z", "dateReserved": "2026-08-09T03:40:39.900Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:51:46.675Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/ipvs/ip_vs_conn.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "9e36602cbec552286f7e691cfd366525c565ee74", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}, {"lessThan": "2975324d164c552b028632f107b567302863b7f6", "status": "affected", "version": "9a05475cebdd6341884b5901e53870be26e65158", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/ipvs/ip_vs_conn.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."}], "id": "CVE-2026-72020", "lastModified": "2026-10-19T22:17:22.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72020", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:50:08.361059Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:21:00.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-457"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new", "id": "2516532", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516532"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-908", "details": ["A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. When a new connection is created from a malformed synchronization message, certain TCP sequence number fields may not be properly initialized. This can lead to forwarded packets containing stale data in their TCP sequence and acknowledgment numbers, potentially corrupting the TCP flow. A remote attacker could exploit this to disrupt network traffic."], "name": "CVE-2026-72020", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72020\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72020\nhttps://lore.kernel.org/linux-cve-announce/2026081509-CVE-2026-72020-d474@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,3bf9a260188b2a5449cbddc032a749ab433fe328)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,6378c5cb360eb1750f88839d7c3613ea92ac1816)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,32c299e28b8eea6cbbd23b97dc61401e9ef9c445)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,9e36602cbec552286f7e691cfd366525c565ee74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,d0eed7177e822cab83141e5c44b2aa345c7fd379)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,83fb4c2c5344f02eac929f66de3c9d1adfcde04c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,6335ab62d5fc9ed875279238233fba3462c168f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a05475cebdd6341884b5901e53870be26e65158,2975324d164c552b028632f107b567302863b7f6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T07:45:04.794408+00:00", "updated": "2026-10-20T13:15:14.199493+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}