VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98078: Linux kernel · ipvs: fix reversed sequence option serialization

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f487b5788f15c6c32a219ed1480d25c93fc18d30 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f487b5788f15c6c32a219ed1480d25c93fc18d30, e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec, de6cc6ec7932bc530f2bb92005dac9123d50659c +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 986a075795339c5ea1122ce9290dfd5504252eb0, < f487b5788f15c6c32a219ed1480d25c93fc18d30	Fixed in f487b5788f15c6c32a219ed1480d25c93fc18d30
LinuxLinux	Affected ≥ 986a075795339c5ea1122ce9290dfd5504252eb0, < e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec	Fixed in e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec
LinuxLinux	Affected ≥ 986a075795339c5ea1122ce9290dfd5504252eb0, < de6cc6ec7932bc530f2bb92005dac9123d50659c	Fixed in de6cc6ec7932bc530f2bb92005dac9123d50659c
LinuxLinux	Affected ≥ 986a075795339c5ea1122ce9290dfd5504252eb0, < bbc68ba258a4eb0a2ca3b3a105550801aa8b00b0	Fixed in bbc68ba258a4eb0a2ca3b3a105550801aa8b00b0
LinuxLinux	Affected ≥ 986a075795339c5ea1122ce9290dfd5504252eb0, < b04578b74f2d3755548fe9e829e3b2a6c6f966a1	Fixed in b04578b74f2d3755548fe9e829e3b2a6c6f966a1
LinuxLinux	Affected ≥ 986a075795339c5ea1122ce9290dfd5504252eb0, < ae38b2ae16f709c0193e1b4340bde26ef3e2687d	Fixed in ae38b2ae16f709c0193e1b4340bde26ef3e2687d

AI-suggested

A fix is available and has been applied in the Linux kernel. Users and administrators should update to the fixed versions identified by the provided commit hashes to remediate this vulnerability.

Description

A vulnerability in the Linux kernel's IP Virtual Server (ipvs) component involves reversed sequence option serialization. The function hton_seq() was called with arguments in the wrong order, causing 24 bytes of a kmalloc-backed message to remain unwritten. This flaw could lead to disclosure of stale heap data and corruption of live connection sequence state. The issue has been fixed by correcting the argument order in the serialization process.

Impact

The vulnerability can lead to information disclosure of stale heap data and corruption of the live connection sequence state within the ipvs module. This could potentially affect the integrity and confidentiality of network connections managed by ipvs in the Linux kernel version 2.6.39.

Summary

CVE-2026-98078 addresses a serialization bug in the Linux kernel's ipvs module where the hton_seq() function was called with reversed arguments, resulting in 24 bytes of the message buffer not being written. This improper serialization may disclose stale heap data and overwrite the live connection sequence state with invalid data from the buffer. The fix involves passing the connection sequence state as the source and the message payload as the destination for both sequence blocks, ensuring proper serialization.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:51 UTC

Technical details

References

Community reviews

Related threats