CVE-2026-90141
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix integer overflow in ftp helper port/address parsing ip_vs_ftp_get_addrport() accumulates decimal digits into a __u16 (hport) and into unsigned char (p[]) without checking for overflow. A crafted FTP PASV/EPSV response with an over-long port or address octet wraps the value, so the helper configures the data connection with a truncated port/address. The netfilter conntrack FTP helper had the same defect, fixed in commit 2b413fc689ba ("netfilter: nf_conntrack_ftp: avoid u16 overflows"). Apply the equivalent fix here: widen the port accumulator to u32 and reject values above 65535, and reject address octets above 255.
How to fix
- Linux Linuxd02de9a7a7e2484da0cf37e50614840623b98a62, fc1493c905d7e0bc8830c1d83915cb7831daf1a1, 50cb9b7263a2ed01f7d2f97818a800c2ee05f661, deaa88fa010ba0dfc554d09e006ddd1ce9945c82, 00bcc6d679262ea42688fba1d7819ea6e56f12ef, 4aed450adaee3a021db27be94c61fe025b0d05ff, b1908bff0faaa94d55be72da65879cad632e8236, e625a9477d12baaff4025c5f9989184a907ea8fc or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < d02de9a7a7e2484da0cf37e50614840623b98a62, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < fc1493c905d7e0bc8830c1d83915cb7831daf1a1, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 50cb9b7263a2ed01f7d2f97818a800c2ee05f661, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < deaa88fa010ba0dfc554d09e006ddd1ce9945c82, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 00bcc6d679262ea42688fba1d7819ea6e56f12ef, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 4aed450adaee3a021db27be94c61fe025b0d05ff, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < b1908bff0faaa94d55be72da65879cad632e8236, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < e625a9477d12baaff4025c5f9989184a907ea8fc, 2.6.12 | d02de9a7a7e2484da0cf37e50614840623b98a62, fc1493c905d7e0bc8830c1d83915cb7831daf1a1, 50cb9b7263a2ed01f7d2f97818a800c2ee05f661, deaa88fa010ba0dfc554d09e006ddd1ce9945c82, 00bcc6d679262ea42688fba1d7819ea6e56f12ef, 4aed450adaee3a021db27be94c61fe025b0d05ff, b1908bff0faaa94d55be72da65879cad632e8236, e625a9477d12baaff4025c5f9989184a907ea8fc |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.