CVE-2026-97596
In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template state range and still store the value in the connection. A template can be returned by ordinary connection lookup. TCP and SCTP then use the invalid state as an index into their transition tables. Reject invalid template states in both sync protocol versions before looking up or modifying a connection. The version 1 path handles both IPv4 and IPv6 records.
Affected versions
Linux kernel versions
4.19
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.111,
6.18.53,
7.2.7,
7.3-rc3
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-97596?
CVE-2026-97596 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.19 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-97596 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-97596?
Yes. CVE-2026-97596 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 4.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-97596 actively exploited?
No. CVE-2026-97596 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.