CVE-2026-45850: Linux Kernel IPVS Checksum Vulnerability

CVE-2026-45850 Overview

CVE-2026-45850 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw causes protocol checksum validation to fail for IPv6 packets that contain extension headers before the protocol header. The IPVS code did not account for the offset introduced by IPv6 extension headers when computing checksums, leading to incorrect validation results. Maintainers resolved the issue by using iph->len, which already contains the appropriate offset, to skip past extension headers during checksum checks.

Critical Impact
IPv6 traffic traversing IPVS load balancers with extension headers may be incorrectly handled, which can disrupt connection processing and load balancing behavior on affected kernels.

Affected Products

Linux kernel (IPVS subsystem) — versions prior to the fix commits
Distributions shipping vulnerable Linux kernel builds with IPVS enabled
Load balancer deployments relying on ip_vs for IPv6 traffic

Discovery Timeline

2026-05-27 - CVE-2026-45850 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45850

Vulnerability Analysis

The vulnerability resides in the IPVS checksum validation logic for IPv6 packets. IPv6 allows optional extension headers, such as Hop-by-Hop Options, Routing, and Fragment headers, to appear between the fixed IPv6 header and the transport protocol header. The IPVS code assumed the transport header immediately followed the IPv6 header. When extension headers were present, checksum validation operated on the wrong offset and failed.

This classifies as an input validation error [CWE-20] in network protocol handling. The fix uses iph->len, which already holds the correct offset past any extension headers, to anchor checksum computation at the true start of the protocol header.

Root Cause

The root cause is the IPVS module not advancing past IPv6 extension headers before invoking protocol-level checksum routines. The code path treated the byte immediately after the 40-byte IPv6 header as the protocol header, ignoring that Next Header chains can extend this offset. Because iph->len already tracks the cumulative header length, the corrected code reuses it instead of recomputing offsets independently.

Attack Vector

A remote source can send crafted IPv6 packets containing extension headers through an IPVS-fronted service. The mismatched checksum validation can cause IPVS to drop legitimate traffic or process packets inconsistently. The published advisory does not document remote code execution or privilege escalation. The primary observable effect is degraded reliability of IPv6 load balancing rather than memory corruption.

No verified exploit code is publicly available. Refer to the upstream commits for the technical fix: Kernel Git Commit a3ca2776 and Kernel Git Commit 05cfe986.

Detection Methods for CVE-2026-45850

Indicators of Compromise

Unexpected drops or connection failures for IPv6 traffic traversing IPVS-based load balancers
Kernel logs referencing IPVS checksum failures on IPv6 flows containing extension headers
Inconsistent backend selection or session distribution for IPv6 clients sending packets with Routing, Hop-by-Hop, or Fragment headers

Detection Strategies

Inventory all Linux hosts running IPVS (ipvsadm -L) and compare running kernel versions against the patched commits in the stable tree
Monitor IPVS counters and kernel ring buffer (dmesg) for checksum-related warnings tied to IPv6 packets
Capture traffic on load balancer interfaces with tcpdump filtering for IPv6 extension headers and correlate with backend reachability failures

Monitoring Recommendations

Track kernel package versions across the fleet and alert on hosts running pre-patch builds with ip_vs loaded
Watch for anomalous IPv6 connection-reset rates on services fronted by IPVS
Centralize kernel and network telemetry in a SIEM or data lake to correlate kernel patch state with IPv6 traffic anomalies

How to Mitigate CVE-2026-45850

Immediate Actions Required

Identify Linux hosts running IPVS for IPv6 traffic and confirm the kernel version against the upstream fix commits
Schedule kernel updates to a stable release that includes the IPVS extension-header checksum fix
Reboot or live-patch affected systems to load the corrected ip_vs module after updates

Patch Information

The fix is committed upstream in the Linux stable tree. Apply distribution-provided kernel updates that incorporate commits a3ca27762ce8 and 05cfe9863ef0. These commits adjust the IPVS IPv6 path to skip extension headers using iph->len before performing checksum validation. Consult your distribution's security tracker for the exact package version that backports the fix.

Workarounds

Where feasible, route IPv6 traffic that requires extension headers around IPVS until kernels are patched
Restrict ingress of IPv6 packets carrying unnecessary extension headers at upstream firewalls or load balancers
Temporarily disable IPVS for IPv6 services on unpatched hosts if alternative load balancing is available

bash

# Check running kernel and IPVS module state
uname -r
lsmod | grep ip_vs

# Inspect IPVS service table for IPv6 entries
ipvsadm -L -n | grep -E '\[.*:.*\]'

# Apply distribution kernel update (Debian/Ubuntu example)
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')

# Reboot to activate patched kernel
sudo systemctl reboot