Executive brief
A vulnerability in the Linux kernel's IP Virtual Server (IPVS) component could allow a local user to crash the system. IPVS is a load-balancing feature used to distribute network traffic across multiple servers. An exploit of this flaw results in a kernel panic, leading to a complete system outage and disruption of services.
Technical details
A NULL pointer dereference exists in the ip_vs_add_service() function within the IPVS (IP Virtual Server) module of the Linux kernel. When ip_vs_bind_scheduler() succeeds, a local variable 'sched' is incorrectly set to NULL; if a subsequent call to ip_vs_start_estimator() fails, the error cleanup path calls ip_vs_unbind_scheduler() with this NULL pointer. This results in a kernel panic (general protection fault) when the code attempts to dereference sched->done_service. The issue is reachable via setsockopt calls (specifically do_ip_vs_set_ctl). Patches have been released for multiple stable kernel branches including 6.6.y, 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.2 to 6.19.14
Timeline
- 2026-04-01: other: Vulnerability fixed in upstream kernel code
- 2026-05-06: advisory: CVE-2026-43086 published by kernel.org
References
- https://git.kernel.org/stable/c/4039959315008888dd53c37674d33351817a5166
- https://git.kernel.org/stable/c/730663352c9178f33fcf5929f4a37c1f1ca5a693
- https://git.kernel.org/stable/c/9a91797e61d286805ae10a92cc48959c30800556
- https://git.kernel.org/stable/c/a32dabacee111cea083ddd57a03635672e1bff29
- https://git.kernel.org/stable/c/c2ddbe577e2ebf63f2d8fb15cdc7503af70f3e94