CVE-2026-43086

Vulnerability

Overview

In the Linux kernel's IPVS (IP Virtual Server) subsystem, a null-pointer dereference vulnerability exists in the error path of the ip_vs_add_service() function. When ip_vs_bind_scheduler() succeeds, the local variable sched is set to NULL. If a subsequent call to ip_vs_start_estimator() fails, the error cleanup path invokes ip_vs_unbind_scheduler(svc, sched) with sched equal to NULL. Although ip_vs_unbind_scheduler() checks if svc->scheduler is non-NULL (which it is, because the bind succeeded), it then dereferences the NULL sched parameter at sched->done_service, leading to a kernel panic at offset 0x30 from NULL [1].

Exploitation and

Impact

An attacker with the ability to trigger the specific error path in ip_vs_add_service() can cause a denial-of-service (DoS) condition by crashing the kernel. The vulnerability is reachable through the do_ip_vs_set_ vs_set_ctl() function, which is invoked via nf_setsockopt() when configuring IPVS rules. The bug manifests in kernels 6.2 and later, where the error path after ip_vs_start_ vs_start_estimator() failure was introduced [1]. No authentication is required to trigger the issue if the attacker can send crafted IPVS configuration requests, making it a local or potentially remote DoS vector depending on system configuration.

Mitigation

The fix, committed to the Linux kernel stable tree, simply avoids clearing the local sched variable after a successful bind. This ensures that the error path passes the correct scheduler pointer to both ip_vs_unbind_scheduler() and ip_vs_scheduler_put(). The patch is available in multiple stable kernel commits [1][2][3][4]. Users should apply the latest kernel updates from their distribution or compile a patched kernel to remediate the issue.