Cloudanix VulnDB

CVE-2026-80875

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A Linux networking component could misread certain IPv6 packets, potentially affecting how connections are tracked in load balancers.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability causes IPVS TCP state lookup to use a hardcoded IPv6 header size instead of the parsed transport offset, resulting in reads from incorrect packet bytes when extension headers are present.

Why it matters to the business

In IPv6 environments using IPVS load balancing, this can produce incorrect connection state decisions that degrade service reliability or allow traffic handling anomalies; low exploit likelihood keeps operational risk modest 25 days after disclosure.

How an attack unfolds

An attacker crafts IPv6 packets containing extension headers and sends them through an IPVS-enabled path; the miscalculated TCP header offset causes state tracking to examine the wrong data, potentially leading to state confusion or bypassed checks.

How to fix it

Apply the upstream kernel commit that passes the pre-parsed transport offset from ip_vs_set_state() to TCP state lookup; rebuild and deploy the corrected kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the ip_vs_proto_tcp.c source for use of the iph.len offset; test with IPv6 packets containing extension headers to verify correct TCP header access.

Typical attack path

  1. Identify a target using Linux IPVS for IPv6 traffic
  2. Craft IPv6 packets with one or more extension headers preceding TCP
  3. Transmit the packets so they reach the IPVS TCP state handling path
  4. Observe or induce incorrect state decisions due to offset miscalculation

How to detect it

Review IPVS and netfilter kernel logs for unexpected state transitions or header parse warnings on IPv6 traffic; correlate with packet captures containing extension headers.

What your security team should do

  • Schedule kernel updates for all IPVS-enabled hosts within standard change windows given low EPSS and absence from KEV
  • Add IPv6 extension-header test cases to regression suites for load-balancer validation
  • Monitor IPVS-related kernel logs for anomalous state transitions until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeof(struct ipv6hdr), while the surrounding IPVS code already parsed the packet with ip_vs_fill_iph_skb() and has the real transport-header offset in iph.len. This makes TCP state handling look at the wrong bytes when an IPv6 packet carries extension headers. Use the parsed transport offset passed down from ip_vs_set_state() when reading the TCP header. For IPv4 and for IPv6 packets without extension headers, the passed offset matches the previous value.

Affected packages

Ecosystem Package Introduced Fixed