Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U L N L 4.4 .0015 3.8 —
AFFECTED Product Versions Fixed Linux 986a075795339c5ea1122ce9290dfd5504252eb0 – — Linux 2.6.39 – 5.10.271
TIMELINE Sep 25 Reserved by Linux Sep 25 Published (CNA: Linux) Oct 8 ENRICHED — CVE-2026-98078 (Linux). Received CVSS 4.4 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization hton_seq() expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks. This leaves 24 bytes of the kmalloc-backed message unwritten. It may disclose stale heap data and replace the live connection sequence state with values read from the buffer. Pass the connection sequence state as the source and the message payload as the destination for both blocks.
| Date | Event | Detail |
|---|---|---|
| September 25, 2026 | Reserved | Reserved by Linux |
| September 25, 2026 | Published | Published (CNA: Linux) |
| October 8, 2026 | ENRICHED | ENRICHED — CVE-2026-98078 (Linux). Received CVSS 4.4 and CPE data from NVD. |
Authoritative record: CVE-2026-98078 at cve.org
Vendors: linux
Weaknesses: CWE-125
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-98078 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
