The Linux kernel IPVS module allocates connection objects without fully resetting the ip_vs_seq structures; only the delta fields are cleared while init_seq and previous_delta remain uninitialized. When a sync message creates a new connection and carries these stale values, the helper functions vs_fix_seq and vs_fix_ack_seq later rewrite TCP sequence and acknowledgment numbers using them. The result is that forwarded packets may contain corrupted or stale TCP seq/ack numbers, which can compromise the integrity of TCP flows between clients and backend servers.

All Linux kernel builds that implement the IPVS virtual server, including standard distributions and any custom kernels that include IPVS, are affected. The vulnerability exists in a kernel version prior to the patch that adds comprehensive ip_vs_seq initialization and remains present in any build that does not apply that change.

The CVSS score of 9.8 places this flaw in the critical category, while the EPSS score of less than 1% indicates a relatively low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the injection of a malformed sync message over the IPVS synchronization channel, which may be achieved by compromising a sync peer or by bypassing trust boundaries on the network. Successful exploitation could enable an attacker to manipulate TCP sequence numbers and disrupt TCP flows without requiring elevated privileges on the target machine.