CVE-2026-72020

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reset full ipvsseq structs in ipvsconn_new

Commit 9a05475cebdd ("ipvs: avoid kmemcachezalloc in

ipvsconnnew") changed ipvsconnnew() to allocate an ipvsconn

object with kmemcachealloc().  The function then initializes many

fields explicitly, but only resets inseq.delta and outseq.delta in the

two struct ipvsseq members.

That leaves initseq and previousdelta uninitialized.  This is normally

harmless while the corresponding IPVSCONNFIN_SEQ or

IPVSCONNFOUT_SEQ flag is clear.  For connections learned from a sync

message, however, ipvsproc_conn() preserves those flags from

IPVSCONNFBACKUP_MASK and passes opt=NULL when the message omits

IPVSOPTSEQ_DATA.  In that case the new connection can be hashed with

SEQ flags set but with the rest of inseq/outseq still containing stale

slab data.

When a packet for such a connection is later handled by an IPVS

application helper, vsfixseq() and vsfixack_seq() use

previousdelta and initseq to rewrite TCP sequence numbers.  A malformed

sync message can therefore make forwarded packets carry stale slab bytes

in their TCP seq/ack numbers, and can also corrupt the forwarded TCP

flow.

Reset both struct ipvsseq members completely before publishing the

connection.  This matches the existing "reset struct ipvsseq" comment

and keeps the sequence-adjustment gates inactive unless valid sequence

data is installed later.