Executive brief
A vulnerability was identified in the Linux kernel's IP Virtual Server (IPVS) component, which is used for load balancing network traffic. The system fails to correctly validate security checksums for IPv6 network traffic when specific optional headers are present. This could lead to improper handling of network packets, potentially affecting the reliability or security of load-balanced services.
Technical details
A vulnerability in the Linux kernel IPVS (IP Virtual Server) implementation causes protocol checksum validation to fail for IPv6 packets that contain extension headers. The root cause is that the checksum verification functions for TCP, UDP, and SCTP (tcp_csum_check, udp_csum_check, and sctp_csum_check) were not correctly accounting for the offset created by IPv6 extension headers, leading them to calculate checksums from the wrong data position. An attacker could potentially send specially crafted IPv6 packets with extension headers to trigger this validation failure. This issue affects systems using IPVS for load balancing (DNAT/SNAT). The fix involves using the correct header length offset already present in the IP header structure to skip extension headers during checksum verification.
Affected products
- Linux Linux Kernel All versions prior to the fix in February 2026
Timeline
- 2026-02-14: patched: Initial patch authored by Julian Anastasov
- 2026-05-27: advisory: CVE-2026-45850 published