Executive brief
The Linux kernel's IP Virtual Server (IPVS) load balancing and traffic management subsystem was missing proper checksum validation for certain protocol packets, particularly ICMPv6 messages. This could allow an attacker to inject crafted packets that bypass integrity checks, potentially leading to packet spoofing or manipulation of network traffic flowing through systems using IPVS.
Technical details
The vulnerability exists in the IPVS module's packet validation logic, specifically in the ip_vs_in_icmp_v6() function which lacked checksum validation for ICMPv6 packets from clients, and handle_response_icmp() which was missing pseudo-header calculation for ICMPv6 validation from servers. The root cause is inconsistent checksum validation across IPv4/IPv6 and TCP/UDP/ICMP protocols. The fix introduces ip_vs_checksum_common_check() and ip_vs_checksum_needed() helper functions to enforce consistent validation only on LOCAL_IN packets (where hardware validation may not have occurred). No authentication is required; the attack vector is network-based on packets transiting the IPVS system. A patch is available upstream in the Linux kernel stable tree as of 2026-08-09.
Affected products
- Linux Linux kernel multiple versions (see stable tree branches linux-5.x, linux-6.x, linux-7.x)
Timeline
- 2026-09-04: disclosed: CVE-2026-80901 published