CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

CVE-2026-72020: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reset full ip_vs_seq structs in ip_vs_conn_new

Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in
ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn
object with kmem_cache_alloc().  The function then initializes many
fields explicitly, but only resets in_seq.delta and out_seq.delta in the
two struct ip_vs_seq members.

That leaves init_seq and previous_delta uninitialized.  This is normally
harmless while the corresponding IP_VS_CONN_F_IN_SEQ or
IP_VS_CONN_F_OUT_SEQ flag is clear.  For connections learned from a sync
message, however, ip_vs_proc_conn() preserves those flags from
IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
IPVS_OPT_SEQ_DATA.  In that case the new connection can be hashed with
SEQ flags set but with the rest of in_seq/out_seq still containing stale
slab data.

When a packet for such a connection is later handled by an IPVS
application helper, vs_fix_seq() and vs_fix_ack_seq() use
previous_delta and init_seq to rewrite TCP sequence numbers.  A malformed
sync message can therefore make forwarded packets carry stale slab bytes
in their TCP seq/ack numbers, and can also corrupt the forwarded TCP
flow.

Reset both struct ip_vs_seq members completely before publishing the
connection.  This matches the existing "reset struct ip_vs_seq" comment
and keeps the sequence-adjustment gates inactive unless valid sequence
data is installed later.

The Linux kernel CVE team has assigned CVE-2026-72020 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 5.10.261 with commit 3bf9a260188b2a5449cbddc032a749ab433fe328
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 5.15.212 with commit 6378c5cb360eb1750f88839d7c3613ea92ac1816
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 6.1.178 with commit 32c299e28b8eea6cbbd23b97dc61401e9ef9c445
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 6.6.145 with commit 9e36602cbec552286f7e691cfd366525c565ee74
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 6.12.97 with commit d0eed7177e822cab83141e5c44b2aa345c7fd379
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 6.18.40 with commit 83fb4c2c5344f02eac929f66de3c9d1adfcde04c
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 7.1.5 with commit 6335ab62d5fc9ed875279238233fba3462c168f5
	Issue introduced in 3.10 with commit 9a05475cebdd6341884b5901e53870be26e65158 and fixed in 7.2-rc3 with commit 2975324d164c552b028632f107b567302863b7f6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72020
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/ipvs/ip_vs_conn.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328
	https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816
	https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445
	https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74
	https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379
	https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c
	https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5
	https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6