CVE-2026-80875

A flaw was found in the IP Virtual Server (IPVS) component of the Linux kernel. When processing IPv6 packets with extension headers, the TCP state handling incorrectly parses the TCP header by using a fixed size for the IPv6 header instead of the actual transport-header offset. This can cause the system to misinterpret network traffic, potentially leading to a denial of service (DoS) condition.

IPVS TCP state handling can parse the wrong bytes as a TCP header for IPv6 packets that carry extension headers because it used a fixed IPv6 header size instead of the parsed transport offset. A remote host can trigger the affected path by sending IPv6 TCP traffic with extension headers to an IPVS virtual service, causing incorrect TCP state transitions and possible connection handling failures. For the CVSS the PR:N is used because no local account or authenticated user context is needed when the IPVS service is reachable over the network. The issue is network reachable through packet traffic rather than a local control interface. Impact is mainly denial of service for affected flows or IPVS state handling. A limited integrity impact is defensible in the paranoid score because the load balancer connection state can be updated from misparsed header data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.