Executive brief
The Linux kernel's IP Virtual Server (IPVS) module, which is used to load-balance network traffic, contains an information disclosure vulnerability. When processing certain network synchronization messages, uninitialized kernel memory bytes can be leaked into forwarded TCP packets, potentially exposing sensitive data or enabling attackers to corrupt TCP connections passing through affected load balancers.
Technical details
The vulnerability is an information disclosure issue in the IPVS ip_vs_conn_new() function in net/netfilter/ipvs/ip_vs_conn.c. A prior optimization commit (9a05475cebdd) changed memory allocation from kmem_cache_zalloc() (which zeros memory) to kmem_cache_alloc() (which does not), but the initialization code only explicitly reset two fields (in_seq.delta and out_seq.delta) while leaving init_seq and previous_delta uninitialized. When a connection is created from a sync message lacking sequence data, the IPVS_F_SEQ flags can be set while stale slab memory remains in the sequence structures. Later, when TCP sequence number rewriting occurs via vs_fix_seq() and vs_fix_ack_seq(), these uninitialized fields are used, causing stale kernel memory to be written into forwarded packet headers. The fix replaces partial field initialization with complete memset() of both struct ip_vs_seq members. Patches are available in kernel commit 2975324d164c552b028632f107b567302863b7f6 and later stable releases.
Affected products
- Linux Linux kernel All versions from introduction of optimization commit 9a05475cebdd through kernel 6.14+
Timeline
- 2026-08-15: disclosed
- 2026-07-03: patched: Upstream commit 2975324d164c552b028632f107b567302863b7f6