ipvs: use parsed transport offset in SCTP state lookup

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72021
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:21:01 UTC
Updated2026-08-15 06:21:01 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup set_sctp_state() reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped extension headers and found the real transport header. This makes the state machine read from the wrong offset for IPv6 SCTP packets that carry extension headers. For example, an INIT packet with an 8-byte destination options header can be scheduled correctly by sctp_conn_schedule(), but set_sctp_state() reads the first byte of the SCTP verification tag as a DATA chunk type. The connection then moves from NONE to ESTABLISHED instead of INIT1, gets the longer established timeout, and updates the active/inactive destination counters incorrectly. This happens even though the SCTP handshake has not completed. Use the parsed transport offset passed down from ip_vs_set_state() for the SCTP chunk-header lookup. For IPv4 and IPv6 packets without extension headers this preserves the existing offset.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27 git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f 9f94573ab962a9e81954b755da016fa3cd2f5039 git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f 290e9e8389b556efc603522e28bd1543846aa336 git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f 9cb5ac594ca76d3a71803b23b74c835b0721e628 git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f a4a2d2e483d79cc2ad3a170674cf159644acf22b git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f 247d055504dcc852e539b9f7f30d19f9741474bf git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f e5d0bb8871668f20de8f3c94b5ae3f372346bc6e git Not specified
CNA Linux Linux affected 2906f66a5682e5670a5eefe991843689b8d8563f 2f75c0faa3361b28e36cc0512b3299e163e25789 git Not specified
CNA Linux Linux affected 2.6.34 Not specified
CNA Linux Linux unaffected 2.6.34 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/9f94573ab962a9e81954b755da016fa3cd2f5039 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2f75c0faa3361b28e36cc0512b3299e163e25789 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9cb5ac594ca76d3a71803b23b74c835b0721e628 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/290e9e8389b556efc603522e28bd1543846aa336 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e5d0bb8871668f20de8f3c94b5ae3f372346bc6e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/247d055504dcc852e539b9f7f30d19f9741474bf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a4a2d2e483d79cc2ad3a170674cf159644acf22b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report