CVE-2026-68477

Received Received - Intake

Linux kernel IPv6 transport offset vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause problems with apps over IPv6. As for the only official app in the kernel tree (FTP) this problem is harmless because we use Netfilter to mangle the FTP ports and we do not adjust the TCP seq numbers. Also, provide correct offset of the ICMPV6 header in ip_vs_out_icmp_v6() for correct checksum checks when the IPv6 packet has extension headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-68477

EUVD

EUVD-2026-59099

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect IPv6 transport offsets in the IPVS (IP Virtual Server) code. The issue occurs because TCP code assumes an IPv4 network header even when IPv6 is specified, leading to potential problems for applications using IPv6. Additionally, the ICMPv6 header offset was incorrect in the ip_vs_out_icmp_v6() function, which could affect checksum calculations for IPv6 packets with extension headers.

Detection Guidance

This vulnerability involves incorrect IPv6 transport offsets in the Linux kernel's IPVS (IP Virtual Server) module. Detection requires checking kernel logs for IPVS-related errors or verifying if your system uses IPVS with IPv6 traffic. Commands like 'dmesg | grep ipvs' or 'journalctl -k | grep ipvs' may show related errors. Ensure your kernel version is updated to a patched release.

Impact Analysis

If you use IPv6 networking with the Linux kernel, this vulnerability could cause issues for applications relying on correct transport layer handling. However, the impact is limited because the only official kernel application (FTP) is unaffected due to Netfilter port mangling and TCP sequence number adjustments.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It involves incorrect IPv6 transport offsets in the Linux kernel's IPVS (IP Virtual Server) component, which could cause issues with applications over IPv6 but does not impact data protection or privacy requirements.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this issue. If using a distribution with long-term support, apply security patches promptly. Disable IPVS for IPv6 traffic if not required, or restrict IPv6 usage in IPVS configurations until patched.

Hi! I’m here to help you understand CVE-2026-68477. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70