Checksum Validation Flaw in Linux Kernel's IPVS Component

CVE-2026-80901

What is CVE-2026-80901?

A vulnerability in the Linux kernel's IPVS (IP Virtual Server) component has been identified, primarily affecting the validation of checksum for ICMPv6 packets. The issue arises when the function ip_vs_in_icmp_v6() fails to properly validate ICMPv6 checksums originating from clients, a critical oversight particularly when handling packet mangling for masquerading and tunnel replies. Further complicating this, the common function handle_response_icmp() lacks the necessary pseudo-header calculations for validating ICMPv6 messages from actual servers, which is problematic, especially when hardware does not validate the checksum. The resolution includes the creation of the ip_vs_checksum_common_check() helper to enforce checksum validation for these packets, encompassing TCP, UDP, and ICMP for both IPv4 and IPv6 protocols. Importantly, checksum checks are not required for LOCAL_OUT and FORWARD traffic, focusing instead on LOCAL_IN scenarios. This fix emphasizes the need for robust network protocol security to prevent potential exploitation.

References