CVE-2026-80875

ipvs: use parsed transport offset in TCP state lookup

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Sep 4, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: use parsed transport offset in TCP state lookup

TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeof(struct ipv6hdr), while the surrounding IPVS code already parsed the packet with ip_vs_fill_iph_skb() and has the real transport-header offset in iph.len.

This makes TCP state handling look at the wrong bytes when an IPv6 packet carries extension headers. Use the parsed transport offset passed down from ip_vs_set_state() when reading the TCP header.

For IPv4 and for IPv6 packets without extension headers, the passed offset matches the previous value.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 2d06e0897ce18228d199887f0823b431d841dd03Affected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 816efb7fc0aeae986e63ac73b428dd97a4ef69f5Affected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 5848e914b85e360a2dd9d19c00a72e2ea9617dd0Affected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before d45f73c274435703e8d7bc9d8b742a5d9111ab6eAffected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before f6f550f26562d191c30b2818e7925dcb1c7f166cAffected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before d73f4249776dd970ad65a69cfc51613dd8a034bbAffected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before c2ee845e292c278fac75bf28d96bc892607fd5c4Affected 0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 2500fa3958b1ba51c2b065e39db1b04dfa7e23a2Affected
LinuxLinux	2.6.28Affected before 2.6.28Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 2d06e0897ce18228d199887f0823b431d841dd03Affected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 816efb7fc0aeae986e63ac73b428dd97a4ef69f5Affected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 5848e914b85e360a2dd9d19c00a72e2ea9617dd0Affected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before d45f73c274435703e8d7bc9d8b742a5d9111ab6eAffected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before f6f550f26562d191c30b2818e7925dcb1c7f166cAffected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before d73f4249776dd970ad65a69cfc51613dd8a034bbAffected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before c2ee845e292c278fac75bf28d96bc892607fd5c4Affected
0bbdd42b7efa66685b6d74701bcde3a596a3a59d to before 2500fa3958b1ba51c2b065e39db1b04dfa7e23a2Affected

LinuxLinux

2.6.28Affected
before 2.6.28Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.