CRITICAL Introduced in 2.6.28
ipvs Checksum Bypass
CVE-2026-80901
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or on reply for tunnel. Also, Sashiko points out that handle_response_icmp() being common for IPv4 and IPv6 is missing the pseudo-header calculation while validating ICMPv6 messages from real servers which is a problem if checksum is not validated by the hardware. Fix the problems by creating ip_vs_checksum_common_check() helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6. Rely on the nf_checksum() for validating the ICMP messages but use it also for TCP and UDP. Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP. IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum validation on LOCAL_OUT (local clients or local real servers) and on FORWARD (traffic from servers on LAN). Do it only on LOCAL_IN, in case nf_checksum() is not called on PRE_ROUTING. Also, ip_vs_checksum_complete() can be marked static.
02KernelScan AI Analysis
Risk summary
IPVS on Linux kernels since 2.6.28 fails to validate checksums for ICMPv6 packets from clients and for ICMPv6 replies from real servers when hardware checksum offload is not available. An attacker on the network can send crafted packets with invalid checksums that bypass validation, potentially causing corrupted data to be forwarded or processed by the IPVS load balancer. This can lead to data integrity violations or denial of service on systems relying on IPVS for load balancing.
Vulnerability analysis
The kernel's IPVS load balancer fails to validate checksums on incoming ICMPv6 packets from clients. It also miscalculates validation for ICMPv6 reply messages from backend servers when hardware offload is not used. Because of this, packets with invalid checksums are accepted and forwarded instead of being dropped. The fix applies a single, consistent validation step to TCP, UDP, and ICMP traffic for both IPv4 and IPv6, and limits the check to externally received traffic so that locally generated and forwarded packets are not affected. Any remote client can reach the vulnerable path by sending packets to a host running IPVS, with no privileges or user interaction required.
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 2.6.28 | 6.1.183 | d418d73acf8b |
| 6.12 | 2.6.28 | 6.12.103 | 9cbe2c0fdb71 |
| 6.18 | 2.6.28 | 6.18.44 | 00eb23829fd0 |
| 6.6 | 2.6.28 | 6.6.151 | b3869d9b54e7 |
| 7.1 | 2.6.28 | 7.1.8 | 5558a85add07 |
| mainline | 2.6.28 | 7.2 | e876b75b9020 |