CVE-2026-80901

Not scored yetLast modified Nov 6, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix the checksum validations

ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or on reply for tunnel.

Also, Sashiko points out that handle_response_icmp() being common for IPv4 and IPv6 is missing the pseudo-header calculation while validating ICMPv6 messages from real servers which is a problem if checksum is not validated by the hardware.

Fix the problems by creating ip_vs_checksum_common_check() helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6. Rely on the nf_checksum() for validating the ICMP messages but use it also for TCP and UDP.

Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.

IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum validation on LOCAL_OUT (local clients or local real servers) and on FORWARD (traffic from servers on LAN). Do it only on LOCAL_IN, in case nf_checksum() is not called on PRE_ROUTING.

Also, ip_vs_checksum_complete() can be marked static.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 2a3b791e6e1169f374224d164738e9f7be703d77, < d418d73acf8be62744dc47359dfdde8c2148845d; >= 2a3b791e6e1169f374224d164738e9f7be703d77, < b3869d9b54e76dff64118dee4c8fd9302fcd5171; >= 2a3b791e6e1169f374224d164738e9f7be703d77, < 9cbe2c0fdb71904ee929b1851cdc1c73341a03c0; >= 2a3b791e6e1169f374224d164738e9f7be703d77, < 00eb23829fd08df1b5e057cb6b625996a70e7e65; >= 2a3b791e6e1169f374224d164738e9f7be703d77, < 5558a85add073215b298f3e044ff9a6d86d714ae; >= 2a3b791e6e1169f374224d164738e9f7be703d77, < e876b75b9020a97bbdc79721e7fc749024891c65
LinuxLinux2.6.28

References

Timeline

Published
Sep 4, 2026
Last modified
Nov 6, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-80902In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA WhCVE-2026-80903In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak on OA config emit failure xe_oa_emit_oaCVE-2026-80904In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed async decrypt When aCVE-2026-80905In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_header when sending VLAN-tagged frame InCVE-2026-80906In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport_header when sending VLAN-tagged frame CVE-2026-80907In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use CVE-2026-80908In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with dimensions above 4096 Fixes potentCVE-2026-80909In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same cCVE-2026-80919.8Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox CVE-2026-80910In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA CVE-2026-80911In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() IfCVE-2026-80912In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() sec
CVE-2026-80901: Unscored | Vulnix