CVE-2026-80875: Linux Kernel TCP State Handling Vulnerability

CVE-2026-80875 Overview

CVE-2026-80875 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw affects TCP state handling for IPv6 packets that carry extension headers. IPVS reparses the socket buffer to locate the TCP header using sizeof(struct ipv6hdr) as a fixed offset. This ignores the true transport-header offset that ip_vs_fill_iph_skb() already computed and stored in iph.len. As a result, the TCP state machine reads the wrong bytes of the packet when extension headers are present. The kernel maintainers resolved the issue by using the parsed transport offset passed down from ip_vs_set_state().

Critical Impact
Incorrect TCP state transitions in IPVS load balancers processing IPv6 traffic with extension headers, potentially causing connection tracking anomalies or bypass of state-based logic.

Affected Products

Linux kernel — IPVS subsystem (net/netfilter/ipvs)
Distributions shipping affected stable kernel branches referenced by the upstream fix commits
Systems using IPVS as an IPv6 load balancer where clients or servers negotiate extension headers

Discovery Timeline

2026-09-04 - CVE-2026-80875 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80875

Vulnerability Analysis

The IPVS TCP state machine in the Linux kernel handles connection state transitions for load-balanced flows. When processing a packet, it calls back into the socket buffer to locate the TCP header. For IPv6, the previous logic assumed the transport header sits immediately after a fixed-size struct ipv6hdr. IPv6 permits chained extension headers (Hop-by-Hop, Routing, Fragment, Destination Options, and others) between the base header and the transport layer. When those headers are present, the fixed offset points into extension header bytes rather than the TCP header.

The surrounding IPVS code already performs the correct parse through ip_vs_fill_iph_skb(), which walks the header chain and records the real transport offset in iph.len. The bug is that the TCP state lookup discarded this information and recomputed a naive offset. The fix threads the parsed offset from ip_vs_set_state() into the TCP header read path so both IPv4 and IPv6 traffic use the correct location.

Root Cause

The root cause is an inconsistent assumption about the IPv6 header layout between two adjacent code paths in IPVS. One path correctly parses extension headers; the other hardcodes sizeof(struct ipv6hdr). This mismatch produces incorrect input to the TCP state decision logic whenever extension headers are present.

Attack Vector

An attacker on a network path that reaches an IPVS-based IPv6 load balancer can send crafted IPv6 packets containing extension headers followed by a TCP segment. The state lookup then interprets extension header bytes as TCP fields, driving IPVS to make incorrect state decisions. For IPv4, and for IPv6 traffic without extension headers, behavior is unchanged. Refer to the upstream commits (2500fa3, d73f424, f6f550f) for the exact code deltas.

Detection Methods for CVE-2026-80875

Indicators of Compromise

Unexpected IPVS connection state transitions or short-lived entries in ipvsadm -Lnc for IPv6 virtual services.
Kernel log anomalies from net/netfilter/ipvs on hosts routing IPv6 flows with extension headers.
Elevated volumes of IPv6 packets carrying Hop-by-Hop, Routing, or Destination Options headers directed at IPVS VIPs.

Detection Strategies

Inventory Linux hosts running IPVS (ip_vs module loaded) that terminate or forward IPv6 traffic and compare kernel versions against the fixed stable branches.
Capture traffic at the load balancer with tcpdump 'ip6 and (ip6[6] == 0 or ip6[6] == 43 or ip6[6] == 60)' to identify IPv6 extension header usage patterns.
Correlate load balancer health check failures with the presence of IPv6 extension headers in flow telemetry.

Monitoring Recommendations

Forward kernel and IPVS metrics to a centralized data lake for longitudinal comparison across nodes.
Alert on divergence in TCP state distributions between IPv4 and IPv6 virtual services on the same director.
Track kernel package versions across the fleet and flag directors still running unpatched builds.

How to Mitigate CVE-2026-80875

Immediate Actions Required

Identify all IPVS directors handling IPv6 traffic and prioritize them for kernel updates.
Apply the stable kernel update from your distribution that includes the referenced upstream commits.
Reboot into the patched kernel; live-patching is not guaranteed to cover netfilter or IPVS changes.

Patch Information

The fix is applied across multiple stable branches. Reference commits include 2500fa3, 2d06e08, 5848e91, 816efb7, c2ee845, d45f73c, d73f424, and f6f550f. Consult your distribution's security tracker for the corresponding package version.

Workarounds

Where feasible, restrict IPv6 extension header traffic to IPVS VIPs using upstream firewall rules until the kernel is patched.
Prefer IPv4 backends for critical services on directors that cannot be updated immediately.
Isolate unpatched IPVS directors from untrusted IPv6 network segments.

bash

# Verify running kernel and IPVS module status
uname -r
lsmod | grep ip_vs

# Example: drop IPv6 packets with Hop-by-Hop or Destination Options
# headers destined for an IPVS virtual service address (temporary mitigation)
ip6tables -I INPUT -d <VIP6> -m ipv6header --header hop-by-hop --soft -j DROP
ip6tables -I INPUT -d <VIP6> -m ipv6header --header dst --soft -j DROP