In the Linux kernel, IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template state range and still store the value in the connection. This allows an attacker to insert a template with an invalid state that is then used as an index into TCP or SCTP transition tables, causing an out-of-bounds memory access. The flaw is an out-of-bounds array index referred to by CWE‑125. An exploit triggers a kernel panic, resulting in a denial‑of‑service condition on the host.

All Linux kernel installations that enable IPVS synchronization are impacted, regardless of distribution. The affected software is the core kernel; any kernel build that compiles the IPVS module with sync support is vulnerable. The issue applies to both IPv4 and IPv6 sync paths as defined by the upstream patch commits.

The vulnerability has a CVSS score of 5.5. The EPSS score is less than 1 %, indicating a low probability of exploitation at this time. The flaw is not catalogued in CISA’s KEV database. The likely attack vector requires control over the IPVS sync stream; an attacker that can inject crafted sync packets into a cluster can trigger the crash. As a kernel defect, the impact is local to the host hosting the sync receiver, and a crash would render the IPVS service—and possibly the entire system—unavailable until rebooted.