Executive brief
The Linux kernel's IP Virtual Server (IPVS) load balancing module miscalculates the position of TCP packet headers when IPv6 extension headers are present, causing it to examine incorrect bytes in network traffic. This can lead to incorrect TCP state tracking and connection handling for IPv6-based services, potentially affecting load balancing accuracy and service reliability on systems using IPVS.
Technical details
The vulnerability is an off-by-one byte offset bug in the TCP state transition handler within the IPVS netfilter module (net/netfilter/ipvs/ip_vs_proto_tcp.c). The code was using a hardcoded offset based on sizeof(struct ipv6hdr) instead of the dynamically-parsed transport header offset calculated by ip_vs_fill_iph_skb(), which accounts for IPv6 extension headers. When IPv6 packets carry extension headers (e.g., routing headers, fragment headers), the code would read the TCP header from the wrong offset, corrupting state tracking. The fix replaces the hardcoded offset calculation with the pre-computed iph_len parameter already available in the function context. The attack vector is network-based: any IPv6 packet with extension headers transiting through an IPVS-enabled system can trigger the incorrect parsing. No authentication is required.
Affected products
- Linux Linux kernel multiple versions (see stable branches linux-5.0.y through linux-7.2.y and others)
Timeline
- 2026-09-04: disclosed: CVE-2026-80875 published on NVD
- 2026-07-08: patched: Fix committed upstream (2500fa3958b1ba51c2b065e39db1b04dfa7e23a2)