Linux Kernel Vulnerability in IPVS Scheduler Affecting Multiple Versions

CVE-2026-43086

What is CVE-2026-43086?

A vulnerability has been identified in the Linux kernel's IPVS (IP Virtual Server) implementation. This bug occurs when the ip_vs_add_service function successfully binds a scheduler, but not retaining the correct scheduler reference results in a NULL dereference on error handling, leading to a potential kernel panic. Specifically, if an error happens during the estimation process post-binding, the cleanup function erroneously accesses a NULL pointer, which triggers a critical failure in the system. The issue has been more pronounced in recent kernel versions and must be addressed to ensure system stability and prevent crashes.

References