Executive brief
The Linux kernel's IP Virtual Server (IPVS) load balancer incorrectly parses SCTP protocol state information for IPv6 packets with extension headers, causing it to misidentify connection states. This can cause connections to be treated as established when they are not, resulting in incorrect timeout values and miscounted connection statistics, potentially disrupting SCTP-based services.
Technical details
A logic error in the set_sctp_state() function of the IPVS SCTP transport module causes incorrect packet offset calculation for IPv6 packets carrying extension headers. The function hardcodes the offset using sizeof(struct ipv6hdr) instead of using the parsed transport header offset that has already accounted for variable-length extension headers via ipv6_find_hdr(). This causes the function to read the SCTP chunk type from the wrong byte (reading the SCTP verification tag as a DATA chunk), leading the state machine to incorrectly transition from NONE to ESTABLISHED on INIT packets. The vulnerability requires network packets to traverse an IPVS-configured load balancer, but no special authentication or user interaction is required. The fix passes the correct header length through the call chain to set_sctp_state() so it uses accurate packet offsets for both IPv4 and IPv6.
Affected products
- Linux Linux kernel 5.0 and later (affected since introduction of SCTP IPVS support in commit 2906f66a5682)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix committed upstream (commit 2f75c0faa3361b28e36cc0512b3299e163e25789) and backported to stable kernels