CVE-2026-43086ipvs: fix NULL deref in ip_vs_add_service error path
- 5.5MediumCVSS base score
- 0.12%Exploitation in 30 daysEPSS · top 98% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix NULL deref in ip_vs_add_service error path When ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local variable sched is set to NULL. If ip_vs_start_estimator() subsequently fails, the out_err cleanup calls ip_vs_unbind_scheduler(svc, sched) with sched == NULL. ip_vs_unbind_scheduler() passes the cur_sched NULL check (because svc->scheduler was set by the successful bind) but then dereferences the NULL sched parameter at sched->done_service, causing a kernel panic at offset 0x30 from NULL. Oops: general protection fault, [..] [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] RIP: 0010:ip_vs_unbind_scheduler (net/netfilter/ipvs/ip_vs_sched.c:69) Call Trace: <TASK> ip_vs_add_service.isra.0 (net/netfilter/ipvs/ip_vs_ctl.c:1500) do_ip_vs_set_ctl (net/netfilter/ipvs/ip_vs_ctl.c:2809) nf_setsockopt (net/netfilter/nf_sockopt.c:102) [..] Fix by simply not clearing the local sched variable after a successful bind. ip_vs_unbind_scheduler() already detects whether a scheduler is installed via svc->scheduler, and keeping sched non-NULL ensures the error path passes the correct pointer to both ip_vs_unbind_scheduler() and ip_vs_scheduler_put(). While the bug is older, the problem popups in more recent kernels (6.2), when the new error path is taken after the ip_vs_start_estimator() call.
Timeline
ID reserved
By Linux
- 5 days later
· 5 days later
Published
- 5 days later
· 5 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.12% · top 98% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 705dd34440812735ece298eb5bc153fde9544d42 – < 730663352c9178f33fcf5929f4a37c1f1ca5a693
- affected 705dd34440812735ece298eb5bc153fde9544d42 – < 4039959315008888dd53c37674d33351817a5166
- affected 705dd34440812735ece298eb5bc153fde9544d42 – < a32dabacee111cea083ddd57a03635672e1bff29
- affected 705dd34440812735ece298eb5bc153fde9544d42 – < c2ddbe577e2ebf63f2d8fb15cdc7503af70f3e94
- affected 705dd34440812735ece298eb5bc153fde9544d42 – < 9a91797e61d286805ae10a92cc48959c30800556
- affected 6.2
- unaffected < 6.2
- unaffected 6.6.136 – ≤ 6.6.*
- unaffected 6.12.83 – ≤ 6.12.*
- unaffected 6.18.24 – ≤ 6.18.*
- unaffected 6.19.14 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References5
- https://git.kernel.org/stable/c/730663352c9178f33fcf5929f4a37c1f1ca5a693 (opens in a new tab)
- https://git.kernel.org/stable/c/4039959315008888dd53c37674d33351817a5166 (opens in a new tab)
- https://git.kernel.org/stable/c/a32dabacee111cea083ddd57a03635672e1bff29 (opens in a new tab)
- https://git.kernel.org/stable/c/c2ddbe577e2ebf63f2d8fb15cdc7503af70f3e94 (opens in a new tab)
- https://git.kernel.org/stable/c/9a91797e61d286805ae10a92cc48959c30800556 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-27582 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-43086)Record last updated .