Linux IPVS CVE-2026-98078

Exploitation requires the affected host to be a Linux IPVS (IP Virtual Server / LVS) director running the connection synchronization daemon in master/sender mode using sync protocol version 1 - a non-default, specialized configuration used only on load-balancer clusters. The bug triggers automatically whenever that sender serializes sequence options, so no crafted input is needed, but the limiting factors are significant: the IPVS sync feature must be explicitly enabled and active, and the CVSS marks local access with low privileges (PR:L), meaning an unprivileged remote attacker cannot reach it directly. Realistic impact is confined to deployments that both use IPVS load balancing and have state synchronization configured.

This is a low-priority defensive-patch issue rather than an urgent threat. The CVSS 3.1 base score of 4.4 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) reflects a locally-triggerable, low-privilege flaw with limited confidentiality and availability impact, and EPSS agrees it is unlikely to be exploited at scale (0.20%, 9th percentile). There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' All signals are consistent and point to low real-world risk. One tension worth noting: the CVSS vector is AV:L (local), yet the described information disclosure places stale heap bytes into IPVS sync messages that are transmitted over the network to backup directors - meaning the leaked data may actually be observable to peers on the synchronization segment, so the local-only attack vector may understate the disclosure surface; verify with the sync network topology. Separately, the NVD/CNA vector marks I:N, but the description explicitly states live connection sequence state is overwritten with buffer-read values, which is an integrity effect that appears understated. This is typical of auto-generated Linux kernel CVE scoring and should be treated as approximate.

On a Linux load balancer (LVS/IPVS director) configured as a version 1 connection-sync master, the sender serializes sequence options with reversed arguments, leaving 24 bytes of a kmalloc buffer uninitialized; these stale heap bytes are emitted in the sync message and can disclose adjacent kernel heap contents while also corrupting the replicated connection sequence state on backup nodes. No public exploit code exists, and the attack vector is rated local with low privileges, so realistic abuse is limited to environments where the IPVS sync daemon is actively running.