CVE-2026-43086

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix NULL deref in ipvsadd_service error path

When ipvsbindscheduler() succeeds in ipvsaddservice(), the local variable sched is set to NULL. If ipvsstartestimator() subsequently fails, the outerr cleanup calls ipvsunbindscheduler(svc, sched) with sched == NULL. ipvsunbindscheduler() passes the cursched NULL check (because svc->scheduler was set by the successful bind) but then dereferences the NULL sched parameter at sched->doneservice, causing a kernel panic at offset 0x30 from NULL.

Oops: general protection fault, [..] [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] RIP: 0010:ipvsunbindscheduler (net/netfilter/ipvs/ipvssched.c:69) Call Trace: <TASK> ipvsaddservice.isra.0 (net/netfilter/ipvs/ipvsctl.c:1500) doipvssetctl (net/netfilter/ipvs/ipvsctl.c:2809) nfsetsockopt (net/netfilter/nfsockopt.c:102) [..]

Fix by simply not clearing the local sched variable after a successful bind. ipvsunbindscheduler() already detects whether a scheduler is installed via svc->scheduler, and keeping sched non-NULL ensures the error path passes the correct pointer to both ipvsunbindscheduler() and ipvsscheduler_put().

While the bug is older, the problem popups in more recent kernels (6.2), when the new error path is taken after the ipvsstart_estimator() call.