CVE-2026-90141 Linux CVE debrief

Who should care

Defenders and administrators responsible for Linux kernel-based systems, particularly those utilizing ipvs, should assess their exposure and prioritize patching or mitigation efforts.

Why it matters

CVE-2026-90141 is a high-severity vulnerability in the Linux kernel's ipvs component, caused by an integer overflow in FTP helper port and address parsing. Defenders should prioritize patching and verifying ipvs configurations to prevent potential security risks.

• Verify patch availability and apply updates to prevent potential security risks.
• Assess ipvs configurations for secure data connection settings.
• Monitor for suspicious FTP activity that could be related to this vulnerability.

Technical summary

The Linux kernel's ipvs component is vulnerable to an integer overflow in the FTP helper port and address parsing. This issue arises from the accumulation of decimal digits into __u16 (hport) and unsigned char (p[]) without proper overflow checks in the ip_vs_ftp_get_addrport() function. An attacker could exploit this by crafting a malicious FTP PASV/EPSV response, potentially causing the helper to configure the data connection with a truncated port or address.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly in environments where ipvs is used.

Recommended defensive actions

• Verify Linux kernel versions in use and check for official patches or updates addressing CVE-2026-90141.
• Apply patches or updates as soon as available, particularly in environments utilizing ipvs.
• Review and update configurations for ipvs to ensure secure data connection settings.
• Perform an inventory of assets that may be impacted by this vulnerability.
• Monitor for suspicious FTP activity that could be related to this vulnerability.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed.

Evidence notes

The vulnerability was introduced due to the accumulation of decimal digits into a __u16 (hport) and an unsigned char (p[]) without checking for overflow in the ip_vs_ftp_get_addrport() function. A crafted FTP PASV/EPSV response could trigger this overflow, causing the helper to configure the data connection with a truncated port or address.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.