Linux Kernel CVE-2026-72020

Exploitation requires the target Linux host to be running IPVS/LVS as a load-balancing director configured with connection synchronization in backup mode, so that ip_vs_proc_conn() processes incoming sync messages and preserves IP_VS_CONN_F_IN_SEQ/IP_VS_CONN_F_OUT_SEQ flags from IP_VS_CONN_F_BACKUP_MASK. The attacker must be able to inject a malformed sync message that carries those SEQ flags but omits the IPVS_OPT_SEQ_DATA option (opt=NULL), and the affected connection must later be handled by an IPVS application helper that calls vs_fix_seq()/vs_fix_ack_seq(). Limiting factors: this is a non-default configuration (plain IPVS forwarding without sync is unaffected), the sync channel is typically a dedicated/trusted multicast interface not exposed to the internet, and impact is confined to a small memory leak in TCP seq/ack fields plus flow corruption rather than direct code execution - meaning the CVSS PR:N/AC:L assumption overstates how reachable the vector is in typical deployments.

The signals conflict and should not be taken at face value: the feed carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but that is the conservative kernel/NVD auto-assignment, whereas the actual impact is a bounded leak of a few bytes of slab memory into forwarded TCP seq/ack numbers plus possible corruption of a forwarded TCP flow - not full host confidentiality/integrity/availability compromise. EPSS is low (0.21%, 12th percentile), there is no KEV listing and no known POC, which is consistent with a hard-to-monetize, config-dependent bug rather than a broadly exploited one. Critically, exploitation is gated on the host running IPVS with connection synchronization in backup mode and on the attacker being able to inject crafted sync messages, which normally requires presence on the trusted sync network (often multicast on a dedicated interface) - so the realistic AV:N/AC:L assumption is optimistic for an attacker. Net assessment: patch it in the normal cycle for load-balancer/director hosts and prioritize any IPVS director that accepts sync traffic on an untrusted segment, but this does not warrant emergency treatment on the strength of the 9.8 alone; the high raw score is driven by kernel scoring conservatism, not by demonstrated widespread or high-impact exploitation.

An attacker with access to the load-balancer's connection-sync network sends a crafted IPVS sync message that sets IP_VS_CONN_F_IN_SEQ/OUT_SEQ but omits IPVS_OPT_SEQ_DATA, causing the backup director to create a connection whose sequence-adjustment state is uninitialized slab memory. When traffic for that connection is subsequently forwarded through an IPVS application helper, the director rewrites TCP seq/ack fields with stale kernel bytes, leaking small amounts of kernel memory into the wire and potentially corrupting the TCP flow. No public exploit is identified at time of analysis, and the attack requires the specific sync-backup configuration plus reachability to the sync channel.