< Back

CVE-2026-97596

Updated on 25 Sep 2026

Severity

7.5 High severity

Details

CVSS score
7.5
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ipvs: reject invalid states in connection template sync records

IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template state range and still store the value in the connection.

A template can be returned by ordinary connection lookup. TCP and SCTP then use the invalid state as an index into their transition tables.

Reject invalid template states in both sync protocol versions before looking up or modifying a connection. The version 1 path handles both IPv4 and IPv6 records.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Debian 10 ELS , Debian 11 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 20.04 ELS
Affected packages:
linux @ 5.4.0 (+7 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 12 Planned —
Debian 13 Released
17 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
  • 6.12.101-1
  • 6.12.105-1
  • 6.12.107-1