The Linux kernel’s IPVS subsystem uses the wrong offset when it looks up TCP state for IPv6 packets that contain extension headers. While the surrounding IPVS code already parsed the transport-header offset, the TCP state logic reparses the socket buffer with a fixed IPv6 header size and thus examines the wrong bytes. This incorrect parsing can cause the state machine to misinterpret the packet, potentially leading to malformed routing decisions, inadvertent crashes of the networking stack, or leakage of internal packet information if the corrupted data is used elsewhere. The bug is a classic improper offset calculation, which a malicious actor could trigger by sending a specially crafted IPv6 packet containing extensions. Affected systems are all Linux kernel installations that include the IPVS code path without the recent fix. Because the patch was applied to the kernel’s core networking code, any distribution shipping a kernel version prior to the commit that introduced the correction is potentially vulnerable. The exact version range is not enumerated in the advisory, but any kernel that contains the unpatched ipvs code is affected. Risk and exploitability: No CVSS or EPSS scores are publicly disclosed, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the defect resides in kernel networking code that can be triggered by a locally or remotely crafted IPv6 packet with extensions. A successful exploitation would most likely result in a denial of service by crashing the networking stack or degrade packet handling. The lack of publicly available exploit data does not lower the perceived severity, as the vulnerability is inherent to the kernel and could be abused with sufficient network access. Prompt remediation is advised to prevent potential disruption.

All Linux kernel installations that have not yet incorporated the IPVS transport‑offset fix. This includes any distribution shipping a kernel version that contains the legacy IPVS code path. In practice, any mainstream kernel older than the patch commit is at risk.

Because no CVSS or EPSS score is available and the issue is not catalogued in CISA KEV, the precise impact is uncertain. However, the vulnerability involves core networking logic that can be triggered by a crafted IPv6 packet. The probable exploitation path would deliver a denial of service or incorrect routing. The omission of KEV listing does not negate the risk, as the kernel code is critical; the vulnerability remains a high‑severity concern for affected hosts until the patch is applied.