CVE-2026-72020

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reset full ipvsseq structs in ipvsconn_new

Commit 9a05475cebdd ("ipvs: avoid kmemcachezalloc in ipvsconnnew") changed ipvsconnnew() to allocate an ipvsconn object with kmemcachealloc(). The function then initializes many fields explicitly, but only resets inseq.delta and outseq.delta in the two struct ipvsseq members.

That leaves initseq and previousdelta uninitialized. This is normally harmless while the corresponding IPVSCONNFINSEQ or IPVSCONNFOUTSEQ flag is clear. For connections learned from a sync message, however, ipvsprocconn() preserves those flags from IPVSCONNFBACKUPMASK and passes opt=NULL when the message omits IPVSOPTSEQDATA. In that case the new connection can be hashed with SEQ flags set but with the rest of inseq/out_seq still containing stale slab data.

When a packet for such a connection is later handled by an IPVS application helper, vsfixseq() and vsfixackseq() use previousdelta and init_seq to rewrite TCP sequence numbers. A malformed sync message can therefore make forwarded packets carry stale slab bytes in their TCP seq/ack numbers, and can also corrupt the forwarded TCP flow.

Reset both struct ipvsseq members completely before publishing the connection. This matches the existing "reset struct ipvsseq" comment and keeps the sequence-adjustment gates inactive unless valid sequence data is installed later.