CVE-2026-43086: Linux Kernel IPVS NULL Deref Vulnerability

CVE-2026-43086 Overview

CVE-2026-43086 is a NULL pointer dereference vulnerability in the Linux kernel's IP Virtual Server (IPVS) subsystem. The flaw resides in the ip_vs_add_service() error handling path within net/netfilter/ipvs/ip_vs_ctl.c. When ip_vs_bind_scheduler() succeeds but ip_vs_start_estimator() later fails, the cleanup logic invokes ip_vs_unbind_scheduler() with a NULL sched argument. The function then dereferences sched->done_service, triggering a kernel panic at offset 0x30 from NULL.

The issue surfaces in Linux kernel versions 6.2 and later, where the new error path after ip_vs_start_estimator() was introduced. Maintainers have merged a fix across multiple stable branches.

Critical Impact
Local users with CAP_NET_ADMIN who can configure IPVS services may trigger a kernel panic, resulting in a denial-of-service condition on Linux systems acting as load balancers.

Affected Products

Linux kernel 6.2 and later mainline branches where the new ip_vs_start_estimator() error path is present
Stable kernel trees receiving the IPVS scheduler binding logic
Distributions shipping affected upstream kernels with IPVS (CONFIG_IP_VS) enabled

Discovery Timeline

2026-05-06 - CVE-2026-43086 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43086

Vulnerability Analysis

IPVS is the kernel-level Layer 4 load balancer used by ipvsadm and orchestrators such as kube-proxy. The ip_vs_add_service() function creates a virtual service and binds a scheduler to it. The original code cleared the local sched pointer to NULL after a successful call to ip_vs_bind_scheduler(). This pattern was safe before kernel 6.2 because no further failure path existed.

Kernel 6.2 added a call to ip_vs_start_estimator() after the scheduler bind. When the estimator allocation fails, the function jumps to out_err, which calls ip_vs_unbind_scheduler(svc, sched). At this point sched is NULL, but svc->scheduler is populated. ip_vs_unbind_scheduler() checks cur_sched against svc->scheduler, passes the validation, and then dereferences the NULL sched parameter to invoke sched->done_service, causing a general protection fault.

Root Cause

The defect is a [CWE-476] NULL pointer dereference caused by inconsistent assumptions between caller and callee. ip_vs_add_service() cleared the local pointer for cleanup safety, while ip_vs_unbind_scheduler() expected a valid scheduler reference whenever svc->scheduler was set. The KASAN report confirms the access in the range 0x0000000000000030-0x0000000000000037.

Attack Vector

Triggering the bug requires the ability to call setsockopt() with IP_VS_SO_SET_ADD or equivalent netlink commands, which demand CAP_NET_ADMIN. An attacker with that capability can race or stress estimator allocation to force the failure path. The result is a kernel panic and host-level denial of service. The vulnerability is not remotely exploitable without prior privileged access.

The upstream patch removes the line that nulls sched after a successful bind. With sched retained, the error path passes the correct pointer to both ip_vs_unbind_scheduler() and ip_vs_scheduler_put(). Reference commits include 4039959315008888dd53c37674d33351817a5166 and c2ddbe577e2ebf63f2d8fb15cdc7503af70f3e94.

Detection Methods for CVE-2026-43086

Indicators of Compromise

Kernel ring buffer entries containing general protection fault with RIP: ip_vs_unbind_scheduler in dmesg or /var/log/kern.log.
KASAN reports referencing null-ptr-deref in range [0x0000000000000030-0x0000000000000037] originating from net/netfilter/ipvs/ip_vs_sched.c.
Unexpected host reboots or kernel panics on systems running IPVS-based load balancing such as Kubernetes nodes using kube-proxy in IPVS mode.

Detection Strategies

Inventory kernels with uname -r and cross-reference against the patched stable branches listed in the kernel.org commit references.
Audit loaded modules with lsmod | grep ip_vs to identify hosts where the vulnerable code path is reachable.
Monitor auditd for setsockopt calls associated with IPVS service creation by non-root processes that hold CAP_NET_ADMIN.

Monitoring Recommendations

Forward kernel crash telemetry and kdump output to a centralized SIEM for correlation with IPVS configuration changes.
Alert on repeated ipvsadm -A failures or estimator allocation errors that correlate with kernel oops events.
Track container runtime privilege grants that include CAP_NET_ADMIN on hosts running affected kernels.

How to Mitigate CVE-2026-43086

Immediate Actions Required

Apply the upstream stable kernel update containing the IPVS scheduler error-path fix and reboot affected hosts.
Restrict CAP_NET_ADMIN to trusted workloads and avoid granting it to unprivileged containers.
For Kubernetes clusters using IPVS kube-proxy, schedule rolling node updates after validating the patched kernel.

Patch Information

The fix removes the assignment that clears the local sched variable after a successful ip_vs_bind_scheduler() call. Patched commits are available in the kernel.org stable tree at commit 4039959315008888, commit 730663352c9178f3, commit 9a91797e61d28680, commit a32dabacee111cea, and commit c2ddbe577e2ebf63. Distribution maintainers will backport these into supported kernel packages.

Workarounds

Disable or unload the ip_vs module on hosts that do not require IPVS load balancing using modprobe -r ip_vs.
Switch kube-proxy to iptables mode where operationally feasible until the kernel is patched.
Use seccomp and Pod Security Standards to block setsockopt IPVS control operations from untrusted workloads.

bash

# Configuration example: blacklist the IPVS module on hosts that do not need it
echo 'blacklist ip_vs' | sudo tee /etc/modprobe.d/disable-ipvs.conf
sudo modprobe -r ip_vs
uname -r   # confirm kernel version after patching and reboot