{"api_version":"1","generated_at":"2026-09-26T09:48:43+00:00","cve":"CVE-2026-98078","urls":{"html":"https://cve.report/CVE-2026-98078","api":"https://cve.report/api/cve/CVE-2026-98078.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98078","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98078"},"summary":{"title":"ipvs: fix reversed sequence option serialization","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix reversed sequence option serialization\n\nhton_seq() expects the host-order source first and the unaligned\nnetwork-order destination second. The version 1 sync sender passes these\narguments in reverse for both sequence blocks. This leaves 24 bytes of the\nkmalloc-backed message unwritten. It may disclose stale heap data and\nreplace the live connection sequence state with values read from the\nbuffer.\n\nPass the connection sequence state as the source and the message payload as\nthe destination for both blocks.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:37","updated_at":"2026-09-25 11:17:37"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec","name":"https://git.kernel.org/stable/c/e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b04578b74f2d3755548fe9e829e3b2a6c6f966a1","name":"https://git.kernel.org/stable/c/b04578b74f2d3755548fe9e829e3b2a6c6f966a1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/de6cc6ec7932bc530f2bb92005dac9123d50659c","name":"https://git.kernel.org/stable/c/de6cc6ec7932bc530f2bb92005dac9123d50659c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/524599714558da83747c04952d378155c69f5b6b","name":"https://git.kernel.org/stable/c/524599714558da83747c04952d378155c69f5b6b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98078","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98078","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 986a075795339c5ea1122ce9290dfd5504252eb0 e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 986a075795339c5ea1122ce9290dfd5504252eb0 524599714558da83747c04952d378155c69f5b6b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 986a075795339c5ea1122ce9290dfd5504252eb0 de6cc6ec7932bc530f2bb92005dac9123d50659c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 986a075795339c5ea1122ce9290dfd5504252eb0 b04578b74f2d3755548fe9e829e3b2a6c6f966a1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.39","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.39 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/ipvs/ip_vs_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec","status":"affected","version":"986a075795339c5ea1122ce9290dfd5504252eb0","versionType":"git"},{"lessThan":"524599714558da83747c04952d378155c69f5b6b","status":"affected","version":"986a075795339c5ea1122ce9290dfd5504252eb0","versionType":"git"},{"lessThan":"de6cc6ec7932bc530f2bb92005dac9123d50659c","status":"affected","version":"986a075795339c5ea1122ce9290dfd5504252eb0","versionType":"git"},{"lessThan":"b04578b74f2d3755548fe9e829e3b2a6c6f966a1","status":"affected","version":"986a075795339c5ea1122ce9290dfd5504252eb0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/ipvs/ip_vs_sync.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.39"},{"lessThan":"2.6.39","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc3","versionStartIncluding":"2.6.39","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix reversed sequence option serialization\n\nhton_seq() expects the host-order source first and the unaligned\nnetwork-order destination second. The version 1 sync sender passes these\narguments in reverse for both sequence blocks. This leaves 24 bytes of the\nkmalloc-backed message unwritten. It may disclose stale heap data and\nreplace the live connection sequence state with values read from the\nbuffer.\n\nPass the connection sequence state as the source and the message payload as\nthe destination for both blocks."}],"providerMetadata":{"dateUpdated":"2026-09-25T10:24:16.294Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e1c9f9446d3eaae323f1689f9e5de3b1ad6e47ec"},{"url":"https://git.kernel.org/stable/c/524599714558da83747c04952d378155c69f5b6b"},{"url":"https://git.kernel.org/stable/c/de6cc6ec7932bc530f2bb92005dac9123d50659c"},{"url":"https://git.kernel.org/stable/c/b04578b74f2d3755548fe9e829e3b2a6c6f966a1"}],"title":"ipvs: fix reversed sequence option serialization","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98078","datePublished":"2026-09-25T10:24:16.294Z","dateReserved":"2026-09-25T10:19:56.074Z","dateUpdated":"2026-09-25T10:24:16.294Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:37","lastModifiedDate":"2026-09-25 11:17:37","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98078","Ordinal":"1","Title":"ipvs: fix reversed sequence option serialization","CVE":"CVE-2026-98078","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98078","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix reversed sequence option serialization\n\nhton_seq() expects the host-order source first and the unaligned\nnetwork-order destination second. The version 1 sync sender passes these\narguments in reverse for both sequence blocks. This leaves 24 bytes of the\nkmalloc-backed message unwritten. It may disclose stale heap data and\nreplace the live connection sequence state with values read from the\nbuffer.\n\nPass the connection sequence state as the source and the message payload as\nthe destination for both blocks.","Type":"Description","Title":"ipvs: fix reversed sequence option serialization"}]}}}