SB20260928347 - Improper Validation of Array Index in Linux kernel netfilter ipvs

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Validation of Array Index (CVE-ID: CVE-2026-97596)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds transition table access.

The vulnerability exists due to improper validation of array indices in IPVS connection template synchronization record processing when processing a crafted IPVS synchronization record containing an invalid template state. A remote attacker can send a crafted IPVS synchronization record with an invalid template state to trigger an out-of-bounds transition table access.

The version 1 synchronization path handles both IPv4 and IPv6 records.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0c61f7d8e18a978aec2a16d9acd5f682f1c72476
• https://git.kernel.org/stable/c/50c3f06222eafe9cca7ca51a0ef83311d7cab353
• https://git.kernel.org/stable/c/74cb39735b6cd0aff4b5584158f09376fd97aadf
• https://git.kernel.org/stable/c/fc10dc4511e6e2e2b4098ee115c8e5639471f23d