CVE-2026-68477

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

ipvs: fix more places with wrong ipv6 transport offsets

Sashiko reports for more incorrect IPv6 transport offsets.

The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause problems with apps over IPv6. As for the only official app in the kernel tree (FTP) this problem is harmless because we use Netfilter to mangle the FTP ports and we do not adjust the TCP seq numbers.

Also, provide correct offset of the ICMPV6 header in ip_vs_out_icmp_v6() for correct checksum checks when the IPv6 packet has extension headers.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.76%
Percentil entre todas las CVEs puntuadas: 54
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access75 %
Impacto secundarioT1565.002 Transmitted Data Manipulationimpact55 %

Vulnerabilidad en kernel Linux (AV:N/AC:L/PR:N) en IPVS que afecta procesamiento IPv6. Permite DoS por paquetes malformados o corrupción de datos TCP/checksum en flujos IPv6 sobre servicios remotos expuestos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Encrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-68477",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "613ce63711b8d431bba90781f133c39a21684f87",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "95d4511d81b2b37e5d2bdde5d912e48243eae517",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "3a9dc9b55b53d94613a587604b77d3b20024090c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "a3f0d5b605cd5da5c95279969fb8cea4e55cee5b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "7350eb7ead172ae8024897d4b0f2e15c5318279c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "d4ec18f48ce78a3bf7c999ac908691007375fe99",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "905d7a363ade96a19f214815361e11981142c547",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "lessThan": "b3fe4cbd583895987935a9bdad01c8f9d3a02310",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_app.c",
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.28",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_app.c",
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:20:47.440",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3a9dc9b55b53d94613a587604b77d3b20024090c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/613ce63711b8d431bba90781f133c39a21684f87",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7350eb7ead172ae8024897d4b0f2e15c5318279c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/905d7a363ade96a19f214815361e11981142c547",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/95d4511d81b2b37e5d2bdde5d912e48243eae517",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3f0d5b605cd5da5c95279969fb8cea4e55cee5b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b3fe4cbd583895987935a9bdad01c8f9d3a02310",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d4ec18f48ce78a3bf7c999ac908691007375fe99",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix more places with wrong ipv6 transport offsets\n\nSashiko reports for more incorrect IPv6 transport offsets.\n\nThe app code for TCP was assuming IPv4 network header\neven after the ipvsh argument was provided. This can\ncause problems with apps over IPv6. As for the only\nofficial app in the kernel tree (FTP) this problem is\nharmless because we use Netfilter to mangle the FTP\nports and we do not adjust the TCP seq numbers.\n\nAlso, provide correct offset of the ICMPV6 header in\nip_vs_out_icmp_v6() for correct checksum checks when\nthe IPv6 packet has extension headers."
    }
  ],
  "lastModified": "2026-08-17T06:17:57.187",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}