The vulnerability (CVE-2026-43086) in the Linux kernel IPVS subsystem arises when ip_vs_bind_scheduler() successfully sets a scheduler but ip_vs_start_estimator() subsequently fails. In this error path, ip_vs_unbind_scheduler() is called with a NULL scheduler pointer, which is dereferenced, causing a kernel panic (general protection fault). This results in a denial of service condition. The issue affects various Linux kernel versions prior to 6.8.0-1064.72 and related builds. The vulnerability has a CVSS 3.1 base score of 5.5 (medium severity) with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. The vendor has released patches to fix this issue.

Successful exploitation causes a kernel panic due to NULL pointer dereference in the IPVS subsystem, resulting in denial of service (system crash). There is no confidentiality or integrity impact reported. The attack requires local access with low privileges and no user interaction. The vulnerability does not escalate privileges or expose sensitive data but disrupts system availability.

A patch is available and should be applied by updating the Linux kernel to versions 6.8.0-1064.72 or later (and related fixed versions). After updating, a system reboot is required to apply the fix. Users should follow the vendor's update instructions and recompile any third-party kernel modules due to ABI changes. No additional mitigation is indicated by the vendor advisory.