An unauthenticated attacker can trigger an integer overflow in the Linux kernel IPVS FTP helper, potentially leading to unauthorized data connection redirection.

This vulnerability is an integer overflow flaw within the ip_vs_ftp_get_addrport function. An unauthenticated remote attacker can supply a crafted FTP PASV or EPSV response containing excessive port or address octets, causing the kernel to wrap these values and misconfigure subsequent data connections.

The ability to manipulate FTP data connections can lead to unauthorized access to internal network segments or data interception. With a CVSS score of 7.3, this flaw presents a significant risk to infrastructure availability and confidentiality, particularly for environments relying heavily on IPVS for load balancing FTP traffic.

Immediate Action: Apply the vendor-provided kernel updates to at least version 5.10.270, 5.15.221, or 6.1.188, depending on your current distribution branch.

Proactive Monitoring: Review system logs for unusual FTP traffic patterns or unexpected connection resets originating from load-balanced services.

Compensating Controls: Implement strict firewall rules to restrict FTP traffic to trusted sources and deploy an Intrusion Prevention System (IPS) capable of detecting malformed FTP PASV/EPSV packets.

Public Exploit Available: Unknown

Given the core nature of the Linux kernel and the potential for network-level manipulation, administrators should prioritize patching affected systems. While no public exploits are currently confirmed, the nature of the flaw makes it a viable target for attackers aiming to bypass network segmentation or intercept sensitive traffic. Apply the specified kernel updates during your next maintenance cycle.