CVE-2026-72020 (GCVE-0-2026-72020)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
Summary
In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn object with kmem_cache_alloc(). The function then initializes many fields explicitly, but only resets in_seq.delta and out_seq.delta in the two struct ip_vs_seq members. That leaves init_seq and previous_delta uninitialized. This is normally harmless while the corresponding IP_VS_CONN_F_IN_SEQ or IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync message, however, ip_vs_proc_conn() preserves those flags from IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with SEQ flags set but with the rest of in_seq/out_seq still containing stale slab data. When a packet for such a connection is later handled by an IPVS application helper, vs_fix_seq() and vs_fix_ack_seq() use previous_delta and init_seq to rewrite TCP sequence numbers. A malformed sync message can therefore make forwarded packets carry stale slab bytes in their TCP seq/ack numbers, and can also corrupt the forwarded TCP flow. Reset both struct ip_vs_seq members completely before publishing the connection. This matches the existing "reset struct ip_vs_seq" comment and keeps the sequence-adjustment gates inactive unless valid sequence data is installed later.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 3bf9a260188b2a5449cbddc032a749ab433fe328 (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 6378c5cb360eb1750f88839d7c3613ea92ac1816 (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 32c299e28b8eea6cbbd23b97dc61401e9ef9c445 (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 9e36602cbec552286f7e691cfd366525c565ee74 (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < d0eed7177e822cab83141e5c44b2aa345c7fd379 (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 83fb4c2c5344f02eac929f66de3c9d1adfcde04c (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 6335ab62d5fc9ed875279238233fba3462c168f5 (git)
Affected: 9a05475cebdd6341884b5901e53870be26e65158 , < 2975324d164c552b028632f107b567302863b7f6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "9e36602cbec552286f7e691cfd366525c565ee74",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            },
            {
              "lessThan": "2975324d164c552b028632f107b567302863b7f6",
              "status": "affected",
              "version": "9a05475cebdd6341884b5901e53870be26e65158",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc().  The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized.  This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear.  For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA.  In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers.  A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection.  This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:30.496Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"
        },
        {
          "url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"
        },
        {
          "url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"
        },
        {
          "url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"
        }
      ],
      "title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72020",
    "datePublished": "2026-08-15T05:51:46.675Z",
    "dateReserved": "2026-08-09T03:40:39.900Z",
    "dateUpdated": "2026-08-17T05:39:30.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72020",
      "date": "2026-09-22",
      "epss": "0.00714",
      "percentile": "0.52235"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/ipvs/ip_vs_conn.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9e36602cbec552286f7e691cfd366525c565ee74",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2975324d164c552b028632f107b567302863b7f6",
                    "status": "affected",
                    "version": "9a05475cebdd6341884b5901e53870be26e65158",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/ipvs/ip_vs_conn.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.10"
                  },
                  {
                    "lessThan": "3.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc().  The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized.  This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear.  For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA.  In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers.  A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection.  This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."
          }
        ],
        "id": "CVE-2026-72020",
        "lastModified": "2026-08-17T06:17:59.560",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:00.920",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T17:00:03+00:00",
      "cve": "CVE-2026-72020",
      "id": "CVE-2026-72020",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72020.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-23T00:19:34Z",
      "cve": "CVE-2026-72020",
      "id": "CVE-2026-72020",
      "initial_release_date": "2026-08-18T16:55:11Z",
      "product_status:first_fixed": "164",
      "product_status:known_affected": "607",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "203",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72020",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72020.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.