A flaw exists in the Linux kernel’s IPVS implementation where the hton_seq() helper is called with its arguments reversed in the sync sender path. This mistake leaves portions of a heap‑allocated buffer unwritten, exposing stale data that can be read from the kernel. Because the same buffer is later copied back to live connection state, the replay of uninitialised bytes can overwrite legitimate sequence numbers and tamper with IPVS session management. As a result, the flaw can lead to inadvertent information disclosure of kernel memory and potential disruption of IPVS traffic handling.

The vulnerability targets the Linux kernel, affecting all kernel versions of the Linux operating system that lack the commit fixing the reversed sequence option serialization in the ip_vs module. No specific version range is listed; thus any kernel prior to the patch may be vulnerable.

The CVSS score is 4.4, indicating a moderate severity. The EPSS score is < 1%, suggesting a low probability of exploitation. Exploitation requires the ability to trigger the sync sender path, which can be achieved through crafted IPVS synchronization packets sent to an IPVS setup. The likely attack vector is a remote crafted IPVS sync packet, and the necessity for network-level access to IPVS control interfaces remains. Nonetheless, the potential impact on data confidentiality and availability warrants prompt attention.