CVE-2026-80901: Linux Kernel IPVS Checksum Vulnerability

CVE-2026-80901 Overview

CVE-2026-80901 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw stems from missing checksum validation in ip_vs_in_icmp_v6() for ICMPv6 packets received from clients. Additionally, the shared IPv4/IPv6 helper handle_response_icmp() omits the pseudo-header calculation when validating ICMPv6 messages from real servers, which becomes exploitable when hardware does not perform checksum offload. Improperly validated packets can be forwarded or mangled by the load balancer, producing corrupted traffic on the network. The kernel maintainers resolved the issue by introducing a new ip_vs_checksum_common_check() helper and relying on nf_checksum() for TCP, UDP, and ICMP validation across both address families.

Critical Impact
IPVS may forward or masquerade ICMPv6 and other packets without proper checksum validation, allowing malformed traffic to traverse the load balancer and reach backend servers.

Affected Products

Linux kernel (upstream) — IPVS subsystem
Distributions shipping affected stable kernel branches referenced in the fix commits
Systems using IPVS for load balancing with ICMP/ICMPv6 traffic on LOCAL_IN

Discovery Timeline

2026-09-04 - CVE-2026-80901 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80901

Vulnerability Analysis

The IP Virtual Server (IPVS) is the Linux kernel's Layer 4 load balancer. It processes TCP, UDP, SCTP, and ICMP flows on behalf of clients and real servers. Before the fix, the function ip_vs_in_icmp_v6() did not validate checksums for ICMPv6 packets originating from clients. Because IPVS may mangle packets during masquerade (MASQ) or during reply handling for tunnel mode, forwarding unvalidated packets risks propagating corrupted or crafted headers. The shared helper handle_response_icmp() further failed to include the IPv6 pseudo-header when validating ICMPv6 responses from real servers, so any host relying on software checksumming would accept invalid messages.

Root Cause

The root cause is inconsistent input validation across the IPVS packet processing paths for IPv4 and IPv6. Checksum verification logic for TCP and UDP was not applied uniformly to ICMP, and the IPv6 pseudo-header was omitted from ICMPv6 validation in code shared between address families. ip_vs_checksum_complete() was also broader in visibility than required. The fix consolidates the logic into ip_vs_checksum_common_check(), relies on nf_checksum() for the actual computation, and marks ip_vs_checksum_complete() as static.

Attack Vector

An attacker on a network path reachable by an IPVS director can send ICMPv6 packets with invalid checksums. The director accepts them without validation and may mangle and forward them to real servers. The patch limits validation to LOCAL_IN, since packets on LOCAL_OUT (local clients or local real servers) and FORWARD (traffic from servers on LAN) do not require re-validation, and nf_checksum() typically runs at PRE_ROUTING.

// No verified public exploit code is available for CVE-2026-80901.
// See the upstream commits for the exact patch diff:
//   git.kernel.org commits 00eb238, 5558a85, 9cbe2c0, b3869d9, d418d73, e876b75

Detection Methods for CVE-2026-80901

Indicators of Compromise

Unexpected volumes of ICMPv6 packets directed at IPVS virtual services with malformed checksums.
Backend real servers logging protocol errors or dropping mangled packets forwarded by the director.
Anomalous ICMPv6 error messages arriving at clients that do not correspond to legitimate flows.

Detection Strategies

Compare the running kernel version against fixed stable branches referenced in the upstream commits 00eb238, 5558a85, 9cbe2c0, b3869d9, d418d73, and e876b75.
Inspect IPVS configuration with ipvsadm -Ln to enumerate virtual services exposed to untrusted networks.
Capture ICMPv6 traffic on director interfaces with tcpdump -i <iface> icmp6 and validate checksums offline.

Monitoring Recommendations

Enable kernel logging for IPVS packet debug messages (IP_VS_DBG_RL_PKT) during triage windows to identify malformed packets.
Monitor real server error counters and network protocol counters (netstat -s, ss -s) for ICMPv6 anomalies.
Track kernel package versions across the fleet through a centralized inventory to identify unpatched IPVS directors.

How to Mitigate CVE-2026-80901

Immediate Actions Required

Update affected Linux kernels to a stable release containing the IPVS checksum fix commits.
Restrict ICMPv6 traffic reaching IPVS directors to trusted sources where operationally feasible.
Audit MASQ and tunnel-mode IPVS services, which are the paths that mangle packets and rely on correct checksum validation.

Patch Information

The fix introduces ip_vs_checksum_common_check() and reuses nf_checksum() for TCP, UDP, and ICMP validation across IPv4 and IPv6. Validation is scoped to LOCAL_IN, and ip_vs_checksum_complete() is now static. Apply the vendor kernel update that includes commits 00eb238, 5558a85, 9cbe2c0, b3869d9, d418d73, and e876b75.

Workarounds

Where hardware checksum offload can be confirmed on all ingress paths, the pseudo-header omission is less impactful, but this is not a substitute for patching.
Filter untrusted ICMPv6 traffic upstream of the IPVS director using nftables or ip6tables rules to drop malformed packets.
Prefer Direct Routing (DR) mode where possible for services that do not require packet mangling, reducing exposure to the MASQ path.

bash

# Verify running kernel and IPVS module status
uname -r
lsmod | grep ip_vs
ipvsadm -Ln

# Example: drop ICMPv6 echo requests from untrusted sources at the director
ip6tables -I INPUT -s <untrusted_range> -p icmpv6 --icmpv6-type echo-request -j DROP