CyberSecBulletin
CVE-2026-72020NVD status: Received

Linux: Use of Uninitialized Variable

Published Updated By the CyberSecBulletin desk

CVE-2026-72020 is a critical-severity use of uninitialized variable vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 3bf9a260188b2a5449cbddc032a749ab433fe328, 6378c5cb360eb1750f88839d7c3613ea92ac1816, 32c299e28b8eea6cbbd23b97dc61401e9ef9c445 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.71% chance of exploitation within 30 days, higher than 54% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 3bf9a260188b2a5449cbddc032a749ab433fe328 or 6378c5cb360eb1750f88839d7c3613ea92ac1816 or 32c299e28b8eea6cbbd23b97dc61401e9ef9c445 or 9e36602cbec552286f7e691cfd366525c565ee74, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 3bf9a260188b2a5449cbddc032a749ab433fe328; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 6378c5cb360eb1750f88839d7c3613ea92ac1816; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 32c299e28b8eea6cbbd23b97dc61401e9ef9c445; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 9e36602cbec552286f7e691cfd366525c565ee74; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, d0eed7177e822cab83141e5c44b2aa345c7fd379; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 83fb4c2c5344f02eac929f66de3c9d1adfcde04c; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 6335ab62d5fc9ed875279238233fba3462c168f5; 9a05475cebdd6341884b5901e53870be26e65158 up to, but not including, 2975324d164c552b028632f107b567302863b7f6; and 1 more ranges3bf9a260188b2a5449cbddc032a749ab433fe328, 6378c5cb360eb1750f88839d7c3613ea92ac1816, 32c299e28b8eea6cbbd23b97dc61401e9ef9c445, 9e36602cbec552286f7e691cfd366525c565ee74, d0eed7177e822cab83141e5c44b2aa345c7fd379, 83fb4c2c5344f02eac929f66de3c9d1adfcde04c

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn object with kmem_cache_alloc(). The function then initializes many fields explicitly, but only resets in_seq.delta and out_seq.delta in the two struct ip_vs_seq members. That leaves init_seq and previous_delta uninitialized. This is normally harmless while the corresponding IP_VS_CONN_F_IN_SEQ or IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync message, however, ip_vs_proc_conn() preserves those flags from IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with SEQ flags set but with the rest of in_seq/out_seq still containing stale slab data. When a packet for such a connection is later handled by an IPVS application helper, vs_fix_seq() and vs_fix_ack_seq() use previous_delta and init_seq to rewrite TCP sequence numbers. A malformed sync message can therefore make forwarded packets carry stale slab bytes in their TCP seq/ack numbers, and can also corrupt the forwarded TCP flow. Reset both struct ip_vs_seq members completely before publishing the connection. This matches the existing "reset struct ip_vs_seq" comment and keeps the sequence-adjustment gates inactive unless valid sequence data is installed later.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

How developers prevent this class of flaw

  • Ensure that critical variables are initialized before first use.
  • Most compilers will complain about the use of uninitialized variables if warnings are turned on.
  • When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.

More Use of Uninitialized Variable vulnerabilities (CWE-457)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Uninitialized Variable vulnerabilities

Spotted an error? Tell us.