CVE-2026-90141

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) FTP helper. A remote attacker could exploit an integer overflow vulnerability in the ip_vs_ftp_get_addrport() function by sending a specially crafted FTP PASV/EPSV response. This could cause the FTP helper to configure data connections with truncated port or address values, potentially leading to a denial of service or misrouting of network traffic.

A moderate-impact flaw was found in the Linux kernel's IP Virtual Server (IPVS) FTP connection-tracking helper. The ip_vs_ftp_get_addrport() function in net/netfilter/ipvs/ip_vs_ftp.c accumulates decimal digits from FTP PASV/EPSV responses into a 16-bit port value and 8-bit address octets without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the accumulated value, so the helper configures the FTP data connection with a truncated port or address, potentially causing a denial of service or misrouting of network traffic for deployments using the IPVS FTP helper. The kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, the kernels shipped in Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels used by OpenShift Container Platform 4 and 5 are affected; the Red Hat Enterprise Linux 6 kernel is out of support (OOSS). The fix for the affected products is currently deferred, so it will be delivered in a future scheduled kernel update rather than an immediate erratum; until then the residual risk is limited to disruption or misrouting of FTP data connections handled by the IPVS FTP helper. Red Hat rates this flaw as Moderate severity (CVSS 5.5, local attack vector, availability impact), which is lower than the upstream CVE record's rating of 7.3 with a network attack vector.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.