CVE-2026-72021

A flaw was found in the kernel's IP Virtual Server (IPVS) component. This vulnerability occurs when the set_sctp_state() function incorrectly calculates the offset for Stream Control Transmission Protocol (SCTP) chunk headers in IPv6 packets that contain extension headers. A remote attacker could exploit this by sending specially crafted SCTP packets, causing the connection state machine to transition prematurely to an established state. This can lead to incorrect connection tracking, potentially resulting in a denial of service by mismanaging network resources.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires the system to be actively configured as an IP Virtual Server (IPVS) load balancer processing IPv6 SCTP traffic, limiting the blast radius to specialized networking environments. Default installations do not enable or configure IPVS packet scheduling, meaning standard deployments do not expose the affected state tracking logic. When an affected host processes load-balanced SCTP packets carrying IPv6 extension headers, incorrect connection state tracking can cause resource exhaustion or denial of service, but it does not grant direct privilege escalation or data disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.