In Linux kernel IPVS, the SCTP state lookup incorrectly uses the transport header offset for IPv6 packets that contain extension headers. The routine reads a chunk header from the wrong location, interpreting part of the SCTP verification tag as a chunk type. This causes the state machine to transition directly from NONE to ESTABLISHED, bypassing the normal INIT1 stage, and resulting in improper timeout handling and inaccurate destination counters. The flaw corresponds to buffer over-read and improper input validation (CWE-125, CWE-20).

The problem exists in all Linux kernel releases that ship the IPVS component before the commit that applies the correct offset. No specific version range is provided in the advisory; any kernel incorporating that fix is considered up‑to‑date. Vendors affected are Linux kernel contributors.

The CVSS score of 8.2 indicates high severity. With an EPSS score of less than 1 % and no listing in the CISA KEV catalog, the likelihood of exploitation is low, but not zero. It is inferred that an attacker could remotely inject crafted IPv6 SCTP packets containing extension headers toward the IPVS service, causing the erroneous state transition. This inference follows from the fact that the vulnerability is triggered by incoming traffic and no privileged access is required.