Look up another CVE · open CVE-2026-72021 in the interactive tracker
CVE-2026-72021
ipvs: use parsed transport offset in SCTP state lookup
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/netfilter. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72021 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
set_sctp_state() reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped extension headers and found the real transport header. This makes the state machine read from the wrong offset for IPv6 SCTP packets that carry extension headers. For example, an INIT packet with an 8-byte destination options header can be scheduled correctly by sctp_conn_schedule(), but set_sctp_state() reads the first byte of the SCTP verification tag as a DATA chunk type. The connection then moves from NONE to ESTABLISHED instead of INIT1, gets the longer established timeout, and updates the active/inactive destination counters incorrectly. This happens even though the SCTP handshake has not completed. Use the parsed transport offset passed down from ip_vs_set_state() for the SCTP chunk-header lookup. For IPv4 and IPv6 packets without extension headers this preserves the existing offset.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/netfilter/ipvs/ip_vs_proto_sctp.c
- What this is
- IPVSMAINTAINERS section matched on net/netfilter/ipvs/ · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.2 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.59%, higher than 47.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/netfilter
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.34 | 5.10.261 | d2b8b1557ec0 |
| 2.6.34 | 5.15.212 | 9f94573ab962 |
| 2.6.34 | 6.1.178 | 290e9e8389b5 |
| 2.6.34 | 6.6.145 | 9cb5ac594ca7 |
| 2.6.34 | 6.12.97 | a4a2d2e483d7 |
| 2.6.34 | 6.18.40 | 247d055504dc |
| 2.6.34 | 7.1.5 | e5d0bb887166 |
| 2.6.34 | 7.2 | 2f75c0faa336 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is hit in IPVS netfilter hooks (NF_INET_LOCAL_IN/FORWARD) when remote IPv6 SCTP packets reach a configured virtual-server VIP; no local syscall or ioctl is required.
- AC:LAttack complexity, low
- An attacker can reliably send SCTP INIT packets with an IPv6 Destination Options extension header so set_sctp_state() reads the wrong byte while sctp_conn_schedule() still accepts the flow, reproducing the NONE-to-ESTABLISHED misclassification every time.
- PR:NPrivileges required, none
- Exploitation needs only the ability to send IPv6 SCTP traffic to the load balancer VIP; configuring IPVS requires CAP_NET_ADMIN on the target but that is an operator prerequisite, not an attacker privilege.
- UI:NUser interaction, none
- No victim interaction is required; the state machine corruption is triggered solely by attacker-crafted network packets processed automatically by the IPVS receive path.
- S:UScope, unchanged
- Impact is confined to incorrect IPVS SCTP connection state, timeouts, and backend active/inactive counters on the load balancer; it does not cross a VM, container, or IOMMU security boundary.
- C:NConfidentiality impact, none
- The flaw misinterprets bytes inside the attacker-supplied packet (e.g., SCTP verification tag) via skb_header_pointer(); there is no out-of-bounds kernel memory read or information disclosure primitive.
- I:LIntegrity impact, low
- Wrong chunk-type parsing corrupts IPVS SCTP state tracking, prematurely marks associations ESTABLISHED, skews active/inactive destination counters, and can alter backend selection for load-aware schedulers without giving arbitrary kernel write.
- A:HAvailability impact, high
- False ESTABLISHED transitions apply a 15-minute timeout instead of the 4-second INIT1 timeout, letting an unauthenticated remote attacker pin large numbers of bogus entries in the connection table and deny service on the affected VIP.