CVE-2026-72021

Received Received - Intake

IPVS SCTP State Lookup Offset Vulnerability in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup set_sctp_state() reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped extension headers and found the real transport header. This makes the state machine read from the wrong offset for IPv6 SCTP packets that carry extension headers. For example, an INIT packet with an 8-byte destination options header can be scheduled correctly by sctp_conn_schedule(), but set_sctp_state() reads the first byte of the SCTP verification tag as a DATA chunk type. The connection then moves from NONE to ESTABLISHED instead of INIT1, gets the longer established timeout, and updates the active/inactive destination counters incorrectly. This happens even though the SCTP handshake has not completed. Use the parsed transport offset passed down from ip_vs_set_state() for the SCTP chunk-header lookup. For IPv4 and IPv6 packets without extension headers this preserves the existing offset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72021

EUVD

EUVD-2026-58979

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's IP Virtual Server (IPVS) SCTP state machine. It occurs because set_sctp_state() incorrectly calculates the SCTP chunk header offset for IPv6 packets with extension headers. Instead of using the parsed transport offset, it uses a fixed offset that skips extension headers, causing the state machine to read from the wrong location. This leads to incorrect state transitions, such as moving from NONE to ESTABLISHED prematurely, even before the SCTP handshake completes.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPVS (IP Virtual Server) implementation for SCTP state handling. Detection requires checking kernel logs for SCTP-related errors or misbehavior in IPVS-managed traffic. Monitor for unexpected state transitions or timeouts in SCTP connections. Use commands like 'dmesg | grep -i sctp' or 'journalctl -k | grep -i sctp' to inspect kernel logs for SCTP-related errors.

Impact Analysis

This vulnerability can cause incorrect handling of SCTP connections in IPVS, leading to premature connection state transitions. This may result in improper timeout management, incorrect active/inactive destination counters, and potential disruptions in load balancing for SCTP traffic. Systems using IPVS with SCTP may experience unexpected behavior or degraded performance.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific kernel networking issue rather than data protection or privacy controls.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. If patching is not immediately possible, disable IPVS SCTP support by setting 'ip_vs_sctp' module to 'N' in kernel parameters or unloading it with 'rmmod ip_vs_sctp'. Monitor network traffic for SCTP anomalies and update firewall rules to restrict SCTP traffic if necessary.

Hi! I’m here to help you understand CVE-2026-72021. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70