PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45850 Linux CVE debrief

A vulnerability in the Linux kernel's IP Virtual Server (IPVS) subsystem causes protocol checksum validation to fail for IPv6 packets when extension headers are present before the protocol header. The issue stems from incorrect offset calculation during checksum verification. The fix utilizes the existing iph->len field, which already contains the correct offset, to properly skip IPv6 extension headers. This is a logic error in packet processing that could affect network traffic handling in IPVS deployments using IPv6.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running Linux kernel-based load balancers using IPVS with IPv6 traffic; network infrastructure teams managing IPv6-enabled services; kernel maintainers and distribution vendors packaging stable kernel updates

Technical summary

The IPVS (IP Virtual Server) subsystem in the Linux kernel fails to properly validate protocol checksums for IPv6 packets containing extension headers. The root cause is incorrect offset calculation when locating the protocol header for checksum verification. The vulnerability is resolved by using iph->len, which already accounts for extension header offsets, to correctly position the checksum calculation. This affects IPv6 traffic processing in load balancing scenarios using IPVS.

Defensive priority

medium

Recommended defensive actions

  • Review Linux kernel version and apply stable tree patches for IPVS IPv6 checksum handling if running IPVS with IPv6 workloads
  • Monitor NVD for CVSS scoring once analysis is complete
  • Assess IPVS deployment configurations for IPv6 traffic exposure
  • Verify checksum validation behavior in test environments before production deployment

Evidence notes

The CVE description and kernel commit references confirm this is a resolved logic error in IPv6 extension header handling within IPVS. No CVSS score or severity rating has been assigned as of the CVE publication date. The vulnerability status in NVD is 'Awaiting Analysis'.

Official resources

Disclosed via Linux kernel stable tree commits on 2026-05-27. The vulnerability was resolved with patches to the IPVS IPv6 checksum handling code.