CVE-2026-43086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2

Description A NULL pointer dereference exists in the IPVS component. When ip vs bind scheduler() succeeds within ip vs add service(), the local variable sched is set to NULL. If ip vs start estimator() subsequently fails, the cleanup process calls ip vs unbind scheduler(svc, sched) with a NULL sched parameter. Because svc->scheduler was already set, the function bypasses the initial NULL check and attempts to dereference sched->done service, resulting in a kernel panic.

Recommendations Update the Linux kernel to a version where the local sched variable is no longer cleared after a successful bind in ip vs add service().