Executive brief
The Linux kernel's IP Virtual Server (IPVS) component includes an FTP helper that processes FTP control protocol responses to set up data connections. A flaw in parsing FTP PASV/EPSV responses allows an attacker to craft malicious responses with oversized port or address numbers that overflow the parsing logic, potentially causing the helper to configure connections to unintended addresses or ports and disrupting legitimate FTP service.
Technical details
The vulnerability is an integer overflow in the ip_vs_ftp_get_addrport() function in net/netfilter/ipvs/ip_vs_ftp.c. The function accumulates decimal digits from FTP responses into a __u16 variable (hport) for port numbers and unsigned char arrays (p[]) for address octets without validating that the resulting values remain within valid ranges (ports ≤65535, address octets ≤255). An attacker can craft a malicious FTP PASV or EPSV response with oversized decimal values that wrap around due to integer overflow, causing the helper to configure the data connection with truncated/incorrect port or address values. No authentication is required; the attacker only needs to control the FTP server response. The fix widens the port accumulator to u32 and explicitly rejects values exceeding 65535 for ports and 255 for address octets.
Affected products
- Linux Linux kernel 2.6.12 and later (numerous kernel versions 2.6.12 through 6.19 affected; see stable branches listed)
Timeline
- 2026-09-17: disclosed: CVE-2026-90141 published
- 2026-09-14: patched: Fix committed to stable Linux kernel trees
- 2026-08-13: other: Patch authored by Joas Antonio dos Santos