CVE-2026-90141 ipvs: fix integer overflow in ftp helper port/address parsing
An integer overflow in the Linux kernel IPVS FTP helper allows attackers to truncate port or address values via crafted responses, potentially disrupting connection tracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90141?
CVE-2026-90141 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix integer overflow in ftp helper port/address parsing
ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address.
The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255.
Which versions are affected by CVE-2026-90141?
How do I fix CVE-2026-90141?
Apply the vendor's patch.
Is CVE-2026-90141 being exploited?
There is no known exploitation of CVE-2026-90141 in the wild and no public exploit code.
Sources
Also known as AZL-102327, BELL-CVE-2026-90141, DEBIAN-CVE-2026-90141, GHSA-hcq4-7chf-c998, UBUNTU-CVE-2026-90141.