Medium severity4.4NVD Advisory· Published Sep 25, 2026· Updated Oct 19, 2026
CVE-2026-98078
CVE-2026-98078
Description
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix reversed sequence option serialization
hton_seq() expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks. This leaves 24 bytes of the kmalloc-backed message unwritten. It may disclose stale heap data and replace the live connection sequence state with values read from the buffer.
Pass the connection sequence state as the source and the message payload as the destination for both blocks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5Patches
Vulnerability mechanics
References
8- git.kernel.org/stable/c/524599714558da83747c04952d378155c69f5b6bnvdPatch
- git.kernel.org/stable/c/677ff8ab30a663cde984d8afe86465fd0d81aeefnvdPatch
- git.kernel.org/stable/c/ae38b2ae16f709c0193e1b4340bde26ef3e2687dnvdPatch
- git.kernel.org/stable/c/b04578b74f2d3755548fe9e829e3b2a6c6f966a1nvdPatch
- git.kernel.org/stable/c/bbc68ba258a4eb0a2ca3b3a105550801aa8b00b0nvdPatch
- git.kernel.org/stable/c/de6cc6ec7932bc530f2bb92005dac9123d50659cnvdPatch
- git.kernel.org/stable/c/e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ecnvdPatch
- git.kernel.org/stable/c/f487b5788f15c6c32a219ed1480d25c93fc18d30nvdPatch
News mentions
0No linked articles in our index yet.