CVE-2026-72020

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. When a new connection is created from a malformed synchronization message, certain TCP sequence number fields may not be properly initialized. This can lead to forwarded packets containing stale data in their TCP sequence and acknowledgment numbers, potentially corrupting the TCP flow. A remote attacker could exploit this to disrupt network traffic.

This vulnerability is evaluated as a Moderate severity issue because it requires a specific, non-default configuration where the IP Virtual Server (IPVS) synchronization daemon is actively processing replication messages alongside application helpers. In typical Red Hat Enterprise Linux installations, IPVS connection synchronization services are disabled by default. Successful exploitation depends on an attacker's ability to inject crafted synchronization payloads into the backup daemon network, restricting the risk profile to clusters actively utilizing state synchronization.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.