Junglewise Threat Intelligence

CVE-2026-43086: Linux Kernel NULL pointer dereference in IPVS ip_vs_add_service

CVE-2026-43086 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's IP Virtual Server (IPVS) component could allow a local user to crash the system. IPVS is a load-balancing feature used to distribute network traffic across multiple servers. An exploit of this flaw results in a kernel panic, leading to a complete system outage and disruption of services.

Technical details

A NULL pointer dereference exists in the ip_vs_add_service() function within the IPVS (IP Virtual Server) module of the Linux kernel. When ip_vs_bind_scheduler() succeeds, a local variable 'sched' is incorrectly set to NULL; if a subsequent call to ip_vs_start_estimator() fails, the error cleanup path calls ip_vs_unbind_scheduler() with this NULL pointer. This results in a kernel panic (general protection fault) when the code attempts to dereference sched->done_service. The issue is reachable via setsockopt calls (specifically do_ip_vs_set_ctl). Patches have been released for multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 6.19.y.

Affected products

  • Linux Linux Kernel 6.2 to 6.19.14

Timeline

  • 2026-04-01: other: Vulnerability fixed in upstream kernel code
  • 2026-05-06: advisory: CVE-2026-43086 published by kernel.org

References