CVE-2026-68477

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. This vulnerability arises from incorrect IPv6 transport offsets, where TCP application code might incorrectly assume an IPv4 network header when processing IPv6 packets. Additionally, the ICMPv6 header offset in ip_vs_out_icmp_v6() could be incorrect when IPv6 packets contain extension headers. These issues can lead to problems with applications over IPv6 and affect checksum calculations, potentially causing packet processing errors.

IPVS used IPv4 header length logic when locating the TCP header for IPv6 app processing, and used a fixed IPv6 header length for an ICMPv6 checksum path. IPv6 packets with extension headers can therefore be parsed at the wrong transport offset, causing incorrect application helper behavior or checksum handling in configured IPVS services. For the CVSS the PR:N is selected because a remote peer only needs network reachability to the affected virtual service and does not need local access on the target. The issue is network reachable only when IPVS is configured for IPv6 traffic and a relevant app or ICMPv6 path is used. Impact is mainly limited service disruption or packet handling integrity loss, with no evidence of kernel memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.