CVE-2026-98794: Linux Kernel IPVS Flag Filtering Vulnerability

CVE-2026-98794 Overview

CVE-2026-98794 affects the Linux kernel's IP Virtual Server (IPVS) subsystem, specifically the SYNC protocol used for state replication between master and backup load balancers. The backup server previously accepted connection flag combinations that could corrupt its connection table. An attacker able to inject or craft IPVS SYNC traffic reaching a backup node could trigger inconsistent connection lookups by sending the NO_CPORT+TEMPLATE combination or ONE_PACKET flags that the master never emits. The kernel maintainers resolved the issue by filtering unexpected flags from received SYNC messages for both v0 and v1 of the protocol.

Critical Impact
Malformed IPVS SYNC messages received by a backup load balancer can cause lookups for normal connections to hit template entries, breaking connection state tracking in multiple ways.

Affected Products

Linux kernel (upstream) with IPVS enabled on backup synchronization nodes
Distributions shipping kernels prior to the fix commits referenced in kernel.org stable trees
Deployments using ipvsadm with master/backup SYNC replication for LVS clusters

Discovery Timeline

2026-10-18 - CVE-2026-98794 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98794

Vulnerability Analysis

IPVS supports a master/backup synchronization protocol so that a standby director can take over active connections if the master fails. The protocol itself is not authenticated or integrity-protected by design. Before this fix, the backup node accepted any flag combination contained in a SYNC message and applied it to the connection it created locally. Two specific problems existed. First, the IP_VS_CONN_F_NO_CPORT flag combined with IP_VS_CONN_F_TEMPLATE allowed a normal connection lookup to resolve to a template entry, corrupting connection state semantics. Second, the IP_VS_CONN_F_ONE_PACKET flag is never sent by a legitimate master, yet protocol v0 handling created unhashed connections that were immediately dropped, while protocol v1 masked the flag inconsistently. The patch drops messages carrying the NO_CPORT+TEMPLATE combination and applies IP_VS_CONN_F_BACKUP_MASK to flags from v0 messages for parity with v1. See the kernel commit f96e91748 for the authoritative fix.

Root Cause

The backup receive path in net/netfilter/ipvs/ip_vs_sync.c trusted inbound flag fields without validating that the combination was semantically possible or that the master would ever emit it. Missing flag filtering between protocol v0 and v1 code paths produced inconsistent behavior and enabled template/connection confusion.

Attack Vector

An attacker with the ability to send UDP multicast or unicast IPVS SYNC packets to a backup director — typically requiring access to the dedicated synchronization network segment — can craft messages with the disallowed flag combinations. Successful delivery disrupts the backup's connection table, affecting failover correctness. The IPVS SYNC protocol performs no cryptographic validation, so network-layer isolation is the sole control.

No verified exploit code is available. The vulnerability is described in prose only; refer to the kernel commits listed in the references for the exact code paths modified.

Detection Methods for CVE-2026-98794

Indicators of Compromise

Unexpected IPVS connection table entries on a backup director that do not correspond to active master-side connections.
Kernel log anomalies from ip_vs_sync indicating malformed or dropped SYNC messages after patch deployment.
Inbound UDP traffic to the IPVS SYNC port (default 8848/udp) originating from hosts outside the designated master set.

Detection Strategies

Monitor the running kernel version against the fixed commits (45a9311118, 55d033324f, d7d33c9efa, f4cd1db7d4, f96e91748f) and flag unpatched LVS directors.
Capture and inspect IPVS SYNC traffic on the replication interface to validate that observed flag fields match the subset emitted by a legitimate master.
Alert on any process other than the kernel sending to the SYNC multicast group on cluster nodes.

Monitoring Recommendations

Ingest kernel audit and dmesg events from LVS directors into a centralized log pipeline for correlation with SYNC traffic volumes.
Baseline backup connection counts against master counts; sustained divergence after failover rehearsals warrants investigation.
Track administrative changes to ipvsadm sync daemon configuration and interface bindings.

How to Mitigate CVE-2026-98794

Immediate Actions Required

Upgrade affected Linux kernels to a stable release containing the fix commits referenced on kernel.org stable.
Restrict IPVS SYNC traffic to a dedicated, isolated management VLAN reachable only by cluster directors.
Enumerate all LVS clusters in the environment and verify which nodes operate in backup mode.

Patch Information

The fix is distributed across multiple stable branches. Reference commits: 45a93111835c, 55d033324f67, d7d33c9efa9d, f4cd1db7d421, and f96e91748f63. Apply the vendor-supplied kernel update for your distribution.

Workarounds

Enforce strict host and switch ACLs so only authorized master directors can transmit to the SYNC multicast group or unicast peer.
Disable the IPVS SYNC daemon on backup nodes if automatic state replication is not operationally required until patches are deployed.
Segment the synchronization interface onto a physically or logically isolated network with no routing from untrusted zones.

bash

# Example: restrict inbound IPVS SYNC (default UDP/8848) to known master IPs
iptables -A INPUT -p udp --dport 8848 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p udp --dport 8848 -j DROP

# Verify running kernel includes the fix
uname -r