The Linux kernel IPVS module fails to fully reset the ip_vs_seq structures when allocating a new connection object. Only the delta fields are cleared, leaving init_seq and previous_delta uninitialized. For connections that arrive via a sync message, these stale values are carried into the connection's state and later used by vs_fix_seq() and vs_fix_ack_seq() to rewrite TCP sequence numbers. This results in forwarded packets containing corrupted or stale TCP sequence and acknowledgment numbers, potentially corrupting the TCP flow and allowing an attacker to influence packet ordering or data integrity.

All Linux kernel builds that include the IPVS virtual server implementation are affected. The vulnerability exists in the default kernel source and manifests in any distribution that has not applied the recent patch adding comprehensive ip_vs_seq initialization.

Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the risk remains significant for environments that rely on IPVS synchronization. An attacker who can inject a malicious sync message—either through compromise of a sync peer or via a network medium that bypasses trust boundaries—can cause sequence number manipulation. The attack requires network access to the sync channel and knowledge of IPVS sync protocols, but does not need elevated privileges on the target system. The absence of a publicly available exploit, combined with the lack of a high CVSS score, suggests the threat is moderate to high for multi-node IPVS deployments with untrusted sync peers.