CVE-2026-98794: ipvs: filter some flags received in the backup server
In the Linux kernel, the following vulnerability has been resolved:
ipvs: filter some flags received in the backup server
While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc.
This commit addresses problems from received connection flags or their combinations. We now drop messages as follows:
1. the NOCPORT+TEMPLATE combination allows lookups for normal connections to hit template which can break in many ways. While the master does not sync connections with NOCPORT flag, i.e. before they are established, we still accept NOCPORT without TEMPLATE.
2. ONEPACKET: it is not sent by master, so we do not expect it in backup. Before now it was ignored by IPVSCONNFBACKUPMASK for protocol v1 while protocol v0 created connections that are not hashed and dropped immediately. Better to apply the IPVSCONNFBACKUPMASK also to the flags from v0 messages for consistency with v1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems acting as an IPVS backup server and receiving IPVS SYNC protocol messages are exposed. The issue concerns processing of received synchronization connection flags.
What does an attacker need to exploit it?
An attacker needs to be able to send crafted IPVS SYNC protocol messages to the backup server. The protocol is described as not secure by design, and the affected behavior involves flags or flag combinations received in those messages.
Are all malformed synchronization flags handled the same way after the fix?
No. The backup server drops messages containing the NO_CPORT plus TEMPLATE combination, while NO_CPORT without TEMPLATE remains accepted. It also filters ONE_PACKET consistently for both protocol v0 and v1 messages.