CVE-2026-97596

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) subsystem. An attacker capable of sending network synchronization messages can transmit connection template records containing invalid protocol states, which the sync receiver stores rather than rejects. When the system subsequently processes these connections, protocols such as TCP use the invalid state to index internal transition tables, leading to out-of-bounds memory access that can cause a system crash and Denial of Service (DoS).

A flaw of Moderate impact was found in the Linux kernel's IP Virtual Server (IPVS) subsystem. When processing connection template synchronization records, an IPVS sync receiver only logged protocol states outside the valid template state range instead of rejecting them, storing the invalid state in the connection template. Such a template can later be returned by an ordinary connection lookup, at which point the TCP and SCTP protocol handlers use the invalid state as an index into their state transition tables, causing an out-of-bounds read that can crash the kernel and result in a denial of service. Exploiting this flaw requires the ability to transmit crafted IPVS synchronization messages to a host acting as an IPVS sync receiver; IPVS sync traffic is normally confined to a dedicated, trusted load-balancer sync network rather than exposed to untrusted networks, which limits practical exposure and is reflected in the Moderate severity rating. The flaw affects availability only, with no impact on confidentiality or integrity.

This issue affects the kernel packages in Red Hat Enterprise Linux 9 (including kernel-rt) and Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS, and the RHEL CoreOS 9 based nodes of OpenShift Container Platform 4.13 and later. Red Hat Enterprise Linux 7 and 8 are not affected because the vulnerable code is not present in those releases. Red Hat Enterprise Linux 6 is out of support. Fixes for the affected products are currently deferred to a future update; the residual risk is that, on systems participating in IPVS connection synchronization, an attacker able to inject crafted sync messages on the sync network could crash an affected machine and interrupt service until it is rebooted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Exposure to this issue can be reduced by limiting IPVS synchronization traffic to trusted load-balancer peers only, for example by using firewall rules to filter the UDP traffic sent to the IPVS sync daemon so that only known sync peers can reach it. On systems where IPVS connection synchronization is not required, stopping the IPVS sync daemon (for example with ipvsadm --stop-daemon master or ipvsadm --stop-daemon backup, as appropriate for the configured role) prevents exploitation. Otherwise, there is no mitigation besides updating to a kernel version that contains the fix once one becomes available.