ipvs: fix the checksum validations

Answer in brief

CVE-2026-80901 records a Unknown severity vulnerability in ipvs: fix the checksum validations. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 4, 2026Updated Sep 4, 2026Source checked Sep 4, 2026First seen by HOL Sep 4, 2026Material review Sep 4, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=2a3b791e6e1169f374224d164738e9f7be703d77 <d418d73acf8be62744dc47359dfdde8c2148845d \|\| >=2a3b791e6e1169f374224d164738e9f7be703d77 <b3869d9b54e76dff64118dee4c8fd9302fcd5171 \|\| >=2a3b791e6e1169f374224d164738e9f7be703d77 <9cbe2c0fdb71904ee929b1851cdc1c73341a03c0 \|\| >=2a3b791e6e1169f374224d164738e9f7be703d77 <00eb23829fd08df1b5e057cb6b625996a70e7e65 \|\| >=2a3b791e6e1169f374224d164738e9f7be703d77 <5558a85add073215b298f3e044ff9a6d86d714ae \|\| >=2a3b791e6e1169f374224d164738e9f7be703d77 <e876b75b9020a97bbdc79721e7fc749024891c65	d418d73acf8be62744dc47359dfdde8c2148845d, b3869d9b54e76dff64118dee4c8fd9302fcd5171, 9cbe2c0fdb71904ee929b1851cdc1c73341a03c0, 00eb23829fd08df1b5e057cb6b625996a70e7e65, 5558a85add073215b298f3e044ff9a6d86d714ae, e876b75b9020a97bbdc79721e7fc749024891c65
Linux/Linuxgeneric	2.6.28	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to d418d73acf8be62744dc47359dfdde8c2148845d if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 4, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or on reply for tunnel. Also, Sashiko points out that handle_response_icmp() being common for IPv4 and IPv6 is missing the pseudo-header calculation while validating ICMPv6 messages from real servers which is a problem if checksum is not validated by the hardware. Fix the problems by creating ip_vs_checksum_common_check() helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6. Rely on the nf_checksum() for validating the ICMP messages but use it also for TCP and UDP. Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP. IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum validation on LOCAL_OUT (local clients or local real servers) and on FORWARD (traffic from servers on LAN). Do it only on LOCAL_IN, in case nf_checksum() is not called on PRE_ROUTING. Also, ip_vs_checksum_complete() can be marked static.

Quoted source text, attributed separately from HOL analysis.