CVE-2026-98078: Linux Kernel IPVS Information Disclosure

CVE-2026-98078 Overview

CVE-2026-98078 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw resides in the version 1 sync sender, which reverses argument order when calling hton_seq() during sequence option serialization. The function expects the host-order source first and the unaligned network-order destination second, but both sequence blocks pass these arguments in reverse. This leaves 24 bytes of the kmalloc-backed message unwritten and may disclose stale heap data to synchronization peers. The flaw can also replace live connection sequence state with values read from the uninitialized buffer, corrupting IPVS connection tracking.

Critical Impact
The bug causes 24 bytes of kernel heap memory to leak over the IPVS synchronization channel and overwrites authoritative connection sequence state with stale buffer contents.

Affected Products

Linux kernel (IPVS subsystem, version 1 sync protocol)
Linux distributions shipping affected kernel versions prior to the stable fix commits
Systems using IPVS connection synchronization between load balancer peers

Discovery Timeline

2026-09-25 - CVE-2026-98078 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98078

Vulnerability Analysis

The vulnerability lives in the IPVS version 1 sync sender code path responsible for serializing TCP sequence state into synchronization messages. IPVS uses this channel to replicate connection state between load balancer peers for high-availability failover. The hton_seq() helper converts a host-order sequence structure into its network-order on-wire form. Correct usage requires the live connection state as the source argument and the outgoing message buffer as the destination.

The version 1 sync sender inverted this contract for both the initial and connection sequence blocks. As a result, the function wrote the target message buffer back into the live connection sequence fields and left 24 bytes of the kmalloc-backed outbound buffer untouched. Those bytes carry whatever residual data occupied the slab allocation, which is transmitted to synchronization peers over the network. The fix passes the connection sequence state as the source and the message payload as the destination for both blocks.

Root Cause

The root cause is an argument-order defect [Information Exposure through Uninitialized Memory] in the IPVS version 1 sync sender. Developers transposed source and destination operands for hton_seq() on two consecutive sequence blocks. The compiler cannot detect the swap because both arguments share compatible pointer types.

Attack Vector

An adversary with visibility into the IPVS multicast or unicast sync channel can passively collect 24 bytes of leaked slab memory per synchronized connection. Repeated connection setup amplifies the disclosure volume. Separately, the reversed write corrupts the kernel's own view of the connection's TCP sequence numbers, which can desynchronize failover state and disrupt established flows. See the kernel commits 524599714558, b04578b74f2d, de6cc6ec7932, and e1c9f9446d3e for the authoritative patches.

Detection Methods for CVE-2026-98078

Indicators of Compromise

IPVS sync messages containing non-zero bytes in positions that should be padding or zero-initialized sequence option fields.
Unexpected TCP sequence number drift on IPVS-managed connections immediately after a sync event between peers.
Kernel versions matching the pre-patch commit history for net/netfilter/ipvs/ip_vs_sync.c.

Detection Strategies

Inventory kernel builds across load balancer tiers and compare against the fixed commit hashes listed in the kernel.org references.
Capture IPVS sync traffic on a test segment and inspect version 1 messages for non-deterministic trailing bytes across repeated runs.
Correlate load balancer failover events with abnormal TCP reset volume on backend services, which may indicate corrupted sync state.

Monitoring Recommendations

Monitor IPVS sync interfaces for traffic from unexpected sources, since the sync channel is the exposure surface for leaked heap bytes.
Alert on kernel package versions in configuration management inventory that lag behind the fixed stable releases.
Track ipvsadm --stats counters for connection anomalies that coincide with peer synchronization events.

How to Mitigate CVE-2026-98078

Immediate Actions Required

Apply the Linux stable kernel updates containing the referenced commits to all IPVS directors and failover peers.
Restrict the IPVS sync multicast or unicast channel to a dedicated, trusted management network segment.
Audit load balancer peer sets to confirm no unauthorized hosts can join the IPVS sync group.

Patch Information

The upstream fix is distributed across the Linux stable tree in commits 524599714558, b04578b74f2d, de6cc6ec7932, and e1c9f9446d3e. Deploy the vendor-backported kernel package appropriate to your distribution and reboot affected hosts.

Workarounds

Disable IPVS version 1 sync and fall back to version 0 if operationally acceptable, since the defect is specific to the v1 sender path.
Isolate the IPVS sync network so leaked heap bytes cannot be captured by untrusted observers.
Reduce reliance on connection synchronization during the patch window by preferring session re-establishment over stateful failover.

bash

# Verify running kernel against fixed stable commits
uname -r

# Inspect IPVS sync daemon status
ipvsadm --list --daemon

# Restrict IPVS sync to a dedicated interface (example)
ipvsadm --stop-daemon master
ipvsadm --start-daemon master --mcast-interface=sync0 --syncid=1