A flaw exists in the Linux kernel’s IPVS implementation where the hton_seq() helper is called with its arguments reversed in the sync sender path. This mistake leaves portions of a heap‑allocated buffer unwritten, exposing stale data that can be read from the kernel. Because the same buffer is later copied back to live connection state, the replay of uninitialised bytes can overwrite legitimate sequence numbers and tamper with IPVS session management. As a result, the flaw can lead to inadvertent information disclosure of kernel memory and potential disruption of IPVS traffic handling.

The vulnerability targets the Linux kernel, affecting all kernel versions of the Linux operating system that lack the commit fixing the reversed sequence option serialization in the ip_vs module. No specific version range is listed; thus any kernel prior to the patch may be vulnerable.

The CVSS score is not provided, but the flaw supplies a path that leverages uninitialised memory read to compromise IPVS session integrity. Exploitation requires the ability to trigger the sync sender path, which can be achieved through crafted IPVS synchronization packets sent to an IPVS setup. The likely attack vector is a remote crafted IPVS sync packet, and the likelihood of exploitation is uncertain due to lack of publicly known exploits, the absence of an EPSS score or KEV listing, and the need for network-level access to IPVS control interfaces. Nonetheless, the potential impact on data confidentiality and availability warrants prompt attention.