In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC… (CVE-2026-98794)

The Linux kernel IPVS SYNC protocol is inherently insecure, but this vulnerability addressed specific problems with connection flags received by the backup server. The NO_CPORT+TEMPLATE flag combination could cause lookups for normal connections to incorrectly match template connections, leading to instability. The master does not sync connections with the NO_CPORT flag, but the backup server previously accepted NO_CPORT without TEMPLATE, which was problematic. Additionally, the ONE_PACKET flag, not sent by the master, was ignored in protocol v1 and inconsistently handled in protocol v0, causing connections that were not hashed and dropped immediately. The patch enforces dropping of messages with these flags to prevent potential disruption.

The vulnerability could allow malformed or unexpected connection flags sent to the backup server to disrupt normal IPVS connection handling, potentially causing instability or incorrect connection lookups. While the IPVS SYNC protocol is not secure by design, this fix prevents certain flag combinations that could 'wreak havoc' on the backup server's connection state. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to filter and drop problematic connection flags received by the IPVS backup server. Users should apply the relevant kernel updates that include this commit to protect against this issue. Since the vulnerability is addressed by the patch, no additional mitigation steps are required.