The Linux kernel IPVS module allocates connection objects without fully resetting the ip_vs_seq structures; only the delta fields are cleared while init_seq and previous_delta remain uninitialized. When a sync message creates a new connection and carries these stale values, the helper functions vs_fix_seq and vs_fix_ack_seq later rewrite TCP sequence and acknowledgment numbers using them. The result is that forwarded packets may contain corrupted or stale TCP seq/ack numbers, potentially corrupting the TCP flow and allowing an attacker to influence packet ordering or data integrity.

All Linux kernel builds that implement the IPVS virtual server, including standard distributions and any custom kernels that include IPVS, are affected. The vulnerability exists in a kernel version prior to the patch that adds comprehensive ip_vs_seq initialization and remains present in any build that does not apply that change.

The CVSS score of 9.8 categorizes this flaw as critical, while the EPSS score of less than 1% indicates a relatively low probability of exploitation in the wild. Nevertheless, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the injection of a malformed sync message over the IPVS synchronization channel, which may be achieved by compromising a sync peer or by bypassing trust boundaries on the network. An attacker does not need elevated privileges on the target machine but must be able to communicate with the target’s sync port. Successful exploitation could allow the attacker to manipulate TCP sequence numbers and disrupt TCP flows between clients and backend servers.