CVE-2026-90141

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow exists in the IPVS FTP helper during port and address parsing. The function ip vs ftp get addrport() accumulates decimal digits into a u16 (hport) and an unsigned char (p[]) without performing overflow checks. A specially crafted FTP PASV or EPSV response containing an over-long port or address octet can cause the value to wrap, leading the helper to configure the data connection with a truncated port or address.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.