The Linux kernel ipvs FTP helper function ip_vs_ftp_get_addrport() improperly accumulates decimal digits into a 16-bit unsigned integer (hport) and an unsigned char array (p[]) without overflow checks. This allows crafted FTP PASV/EPSV responses with excessively long port or address octets to cause integer overflow, resulting in truncated port or address values used for data connections. The vulnerability is analogous to a previously fixed defect in the netfilter conntrack FTP helper. The fix involves widening the port accumulator to a 32-bit integer, rejecting port values above 65535 and address octets above 255.

Exploitation could cause the FTP helper to configure data connections with incorrect truncated port or address values, potentially disrupting network traffic or enabling further attacks that rely on incorrect connection parameters. The CVSS v3.1 score is 7.3 (high), indicating a significant impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

A fix has been applied in the Linux kernel to address this vulnerability by widening the port accumulator and validating port and address values. Users should update to a Linux kernel version that includes this fix. Since no specific patch links or affected versions are provided, consult the official Linux kernel advisories or vendor updates for the fixed version details.