The vulnerability involves incorrect assumptions by the Linux kernel’s IPVS component about IPv6 packet structure, specifically wrong transport offsets that caused the TCP code to incorrectly treat IPv4 headers after an IPv6 argument was supplied. This results in malformed packet processing, potentially leading to checksum errors, port corruption, or service disruption for applications routed through IPVS. The only documented use within the kernel tree is the official FTP app, which in practice the issue is harmless because Netfilter mangles FTP ports and TCP sequence numbers are not adjusted. Nonetheless, any IPVS-enabled service that handles IPv6 traffic could be affected by this misinterpretation.

All releases of the Linux kernel that contain the IPVS IPv6 transport offset logic and were released before the patch commit described in the references. No specific version range is provided in the data, so any kernel prior to the inclusion of the fix is potentially affected.

The CVSS score is not available, and the EPSS score is not reported. The vulnerability is not listed in CISA’s KEV, suggesting there are no known public exploits documented. The risk of exploitation would require an attacker to inject crafted IPv6 traffic through an IPVS front‑end, which may be difficult in tightly controlled environments. In the absence of exploitation evidence, the threat is considered low to moderate, but the lack of public CVSS data means exact severity cannot be quantified.