Executive brief
A race condition was identified in the Linux kernel's IP Virtual Server (IPVS) component, which is used for load balancing network traffic. Under specific conditions when a network interface is being shut down, the system could incorrectly cache network routes, leading to a resource leak. While primarily a stability issue, such leaks can eventually lead to system resource exhaustion or unexpected behavior during network configuration changes.
Technical details
A race condition exists between the netdev notifier 'ip_vs_dst_event()' and the IPVS code responsible for caching destination routes (dst). When a network device is transitioning to a 'down' state, the Forwarding Information Base (FIB) may still return a valid route after the IPVS handler has finished. This results in a 'dest_dst' being cached with a reference to a closing device, causing a reference count leak that persists until the destination is manually removed. The fix introduces a 'netif_running()' check within the route acquisition path to ensure new destinations are not attached to devices that are currently closing. This affects both IPv4 and IPv6 transmission paths in 'net/netfilter/ipvs/ip_vs_xmit.c'.
Affected products
- Linux Linux Kernel All versions prior to the fix (specifically affecting IPVS)
Timeline
- 2026-02-14: other: Patch authored by Julian Anastasov
- 2026-05-27: disclosed: CVE published