---
id: CVE-2026-80901
title: 'ipvs: fix the checksum validations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipvs: fix the checksum validations

  ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
  packets from clients. In fact, as for TCP/UDP we should
  validate the ch…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 <
    d418d73acf8be62744dc47359dfdde8c2148845d
  - >-
    Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 <
    b3869d9b54e76dff64118dee4c8fd9302fcd5171
  - >-
    Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 <
    9cbe2c0fdb71904ee929b1851cdc1c73341a03c0
  - >-
    Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 <
    00eb23829fd08df1b5e057cb6b625996a70e7e65
  - >-
    Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 <
    5558a85add073215b298f3e044ff9a6d86d714ae
  - >-
    Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 <
    e876b75b9020a97bbdc79721e7fc749024891c65
  - Linux 2.6.28
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:04:54.112379Z'
published: '2026-09-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:56.501Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80901'
references:
  - url: 'https://git.kernel.org/stable/c/d418d73acf8be62744dc47359dfdde8c2148845d'
  - url: 'https://git.kernel.org/stable/c/b3869d9b54e76dff64118dee4c8fd9302fcd5171'
  - url: 'https://git.kernel.org/stable/c/9cbe2c0fdb71904ee929b1851cdc1c73341a03c0'
  - url: 'https://git.kernel.org/stable/c/00eb23829fd08df1b5e057cb6b625996a70e7e65'
  - url: 'https://git.kernel.org/stable/c/5558a85add073215b298f3e044ff9a6d86d714ae'
  - url: 'https://git.kernel.org/stable/c/e876b75b9020a97bbdc79721e7fc749024891c65'
tags:
  - cve.org
epss: 0.00161
epssPercentile: 0.05291
ingestedAt: '2026-11-06T18:00:12.528Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix the checksum validations

ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6
packets from clients. In fact, as for TCP/UDP we should
validate the checksum for ICMP packets only when we
mangle the packets on MASQ or on reply for tunnel.

Also, Sashiko points out that handle_response_icmp() being
common for IPv4 and IPv6 is missing the pseudo-header
calculation while validating ICMPv6 messages from real
servers which is a problem if checksum is not validated
by the hardware.

Fix the problems by creating ip_vs_checksum_common_check()
helper and use it for TCP/UDP/ICMP both for IPv4 and IPv6.
Rely on the nf_checksum() for validating the ICMP messages
but use it also for TCP and UDP.

Use correct IP offset for IP_VS_DBG_RL_PKT for TCP/UDP/SCTP.

IPVS packets (TCP/UDP/SCTP/ICMP) do not need checksum
validation on LOCAL_OUT (local clients or local real
servers) and on FORWARD (traffic from servers on LAN).
Do it only on LOCAL_IN, in case nf_checksum() is not
called on PRE_ROUTING.

Also, ip_vs_checksum_complete() can be marked static.

## Affected

- `Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 < d418d73acf8be62744dc47359dfdde8c2148845d`
- `Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 < b3869d9b54e76dff64118dee4c8fd9302fcd5171`
- `Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 < 9cbe2c0fdb71904ee929b1851cdc1c73341a03c0`
- `Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 < 00eb23829fd08df1b5e057cb6b625996a70e7e65`
- `Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 < 5558a85add073215b298f3e044ff9a6d86d714ae`
- `Linux >= 2a3b791e6e1169f374224d164738e9f7be703d77 < e876b75b9020a97bbdc79721e7fc749024891c65`
- `Linux 2.6.28`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.