CVE-2026-90141: ipvs: fix integer overflow in ftp helper port/address parsing
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix integer overflow in ftp helper port/address parsing
ipvsftpgetaddrport() accumulates decimal digits into a u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address.
The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nfconntrackftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255.
Affected Software
Event History
Frequently Asked Questions
What traffic must an attacker control to trigger this issue?
An attacker must be able to provide a crafted FTP PASV or EPSV response that is parsed by the IPVS FTP helper. The response needs an over-long port value or address octet that exceeds the valid numeric range.
What is the practical effect of successful exploitation?
The vulnerable parser can wrap oversized decimal values, causing the helper to configure an FTP data connection using a truncated port or address rather than the value represented in the response.
How is the issue fixed?
The fix uses a wider port accumulator and rejects port values above 65535. It also rejects FTP address octets above 255.