{"id":"CVE-2026-98794","kind":"vulnerability","aliases":["CVE-2026-98794"],"related":[],"title":"Linux kernel IPVS: backup server accepts malformed sync connection flags","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: filter some flags received in the backup server\n\nWhile the IPVS SYNC protocol is not secure by design\nwe can still protect the backup server from messages that\ncan wreak havoc.\n\nThis commit addresses problems from received connection flags\nor their combinations. We now drop messages as follows:\n\n1. the NO_CPORT+TEMPLATE combination allows lookups for normal\nconnections to hit template which can break in many ways.\nWhile the master does not sync connections with NO_CPORT flag,\ni.e. before they are established, we still accept NO_CPORT\nwithout TEMPLATE.\n\n2. ONE_PACKET: it is not sent by master, so we do not\nexpect it in backup. Before now it was ignored by\nIP_VS_CONN_F_BACKUP_MASK for protocol v1 while protocol\nv0 created connections that are not hashed and dropped\nimmediately. Better to apply the IP_VS_CONN_F_BACKUP_MASK\nalso to the flags from v0 messages for consistency with v1.","summary":"The Linux kernel's IPVS sync handling on a backup server accepted connection flag combinations (NO_CPORT with TEMPLATE, and ONE_PACKE from protocol v0 messages) that can break connection lookups. The sources do not say what an attacker can obtain beyond disruption of the backup server.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipvs","linux-kernel","load-balancer","runtime","self-hosted"],"not_affected_if":["no-ipvs","no-sync-daemon"],"how_to_check":"- `uname -r` and compare with the fixed kernel version in the vendor advisory: unknown\n- `lsmod | grep ip_vs` to see whether IPVS is loaded on the host: unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit 'ipvs: filter some flags received in the backup server': unknown\n- Reboot after the kernel update so the fixed code is running","status":"open","published_at":"2026-10-18T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:11+00:00","updated_at":"2026-10-25T05:15:11+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:15:11Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'ipvs: filter some flags received in the backup server': unknown\n- Reboot after the kernel update so the fixed code is running","reach":"network","title":"Linux kernel IPVS: backup server accepts malformed sync connection flags","impact":"low","summary":"The Linux kernel's IPVS sync handling on a backup server accepted connection flag combinations (NO_CPORT with TEMPLATE, and ONE_PACKE from protocol v0 messages) that can break connection lookups. The sources do not say what an attacker can obtain beyond disruption of the backup server.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ipvs","load-balancer","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Crafted sync messages can break the backup server's connection table","analyst_note":"Check the NVD entry and the linux-kernel stable commit for the fixed kernel versions and the exact impact of the crafted sync messages.","how_to_check":"- `uname -r` and compare with the fixed kernel version in the vendor advisory: unknown\n- `lsmod | grep ip_vs` to see whether IPVS is loaded on the host: unknown","needs_analyst":true,"not_affected_if":["no-ipvs","no-sync-daemon"],"who_is_affected":"Only hosts running IPVS load balancing with connection synchronization (the backup role receiving sync messages from a master) are relevant. Systems without IPVS or without sync daemons configured are not exposed through this path. The sources do not name specific distributions or versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":3563,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98794':13A,16A '1':134C '2':177C 'accept':6A,39B,172C 'address':119C 'allow':140C 'also':231C 'appli':223C 'attack':66B 'backup':4A,37B,73B,92C,109C,193C,204C,229C 'balanc':23B 'better':221C 'beyond':69B 'break':56B,150C 'combin':42B,127C,139C 'commit':118C 'conn':202C,227C 'connect':9A,40B,57B,123C,144C,160C,213C 'consist':239C 'cport':44B,137C,163C,174C 'creat':212C 'cve':11A,14A 'design':103C 'disrupt':70B 'drop':130C,219C 'establish':169C 'expect':190C 'f':203C,228C 'filter':86C 'flag':10A,41B,88C,124C,164C,234C 'follow':80C,133C 'handl':34B 'hash':217C 'havoc':116C 'hit':146C 'host':27B 'i.e':165C 'ignor':198C 'immedi':220C 'ip':200C,225C 'ipv':3A,17B,32B,85C,96C 'kernel':2A,20B,30B,78C 'linux':1A,19B,29B,77C 'linux-kernel':18B 'load':22B 'load-balanc':21B 'lookup':58B,141C 'malform':7A 'mani':152C 'mask':205C,230C 'master':156C,185C 'messag':53B,112C,131C,237C 'normal':143C 'obtain':68B 'one':48B,178C 'pack':49B 'packet':179C 'problem':120C 'protect':107C 'protocol':51B,98C,207C,210C 'receiv':89C,122C 'resolv':84C 'runtim':24B 'say':63B 'secur':101C 'self':26B 'self-host':25B 'sent':183C 'server':5A,38B,74B,93C,110C 'sourc':60B 'still':106C,171C 'sync':8A,33B,97C,159C 'templat':46B,138C,147C,176C 'v0':52B,211C,236C 'v1':208C,241C 'vs':201C,226C 'vulner':81C 'way':153C 'without':175C 'wreak':115C","nicknames":[],"mitigations":[],"who_affected":"Only hosts running IPVS load balancing with connection synchronization (the backup role receiving sync messages from a master) are relevant. Systems without IPVS or without sync daemons configured are not exposed through this path. The sources do not name specific distributions or versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98794","severity":null,"published_at":"2026-10-18T16:17:33+00:00","modified_at":"2026-10-21T13:21:47+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}