{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-72021",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2026-08-09T03:40:39.900Z",
        "datePublished": "2026-08-15T05:51:47.324Z",
        "dateUpdated": "2026-08-15T05:51:47.324Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-15T05:51:47.324Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: use parsed transport offset in SCTP state lookup\n\nset_sctp_state() reads the SCTP chunk header again in order to drive the\nIPVS SCTP state table. For IPv6 it computes the offset with\nsizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from\nip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped\nextension headers and found the real transport header.\n\nThis makes the state machine read from the wrong offset for IPv6 SCTP\npackets that carry extension headers. For example, an INIT packet with an\n8-byte destination options header can be scheduled correctly by\nsctp_conn_schedule(), but set_sctp_state() reads the first byte of the\nSCTP verification tag as a DATA chunk type. The connection then moves\nfrom NONE to ESTABLISHED instead of INIT1, gets the longer established\ntimeout, and updates the active/inactive destination counters\nincorrectly. This happens even though the SCTP handshake has not\ncompleted.\n\nUse the parsed transport offset passed down from ip_vs_set_state() for\nthe SCTP chunk-header lookup. For IPv4 and IPv6 packets without\nextension headers this preserves the existing offset."
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/netfilter/ipvs/ip_vs_proto_sctp.c"
                    ],
                    "versions": [
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "9f94573ab962a9e81954b755da016fa3cd2f5039",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "290e9e8389b556efc603522e28bd1543846aa336",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "9cb5ac594ca76d3a71803b23b74c835b0721e628",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "a4a2d2e483d79cc2ad3a170674cf159644acf22b",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "247d055504dcc852e539b9f7f30d19f9741474bf",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "e5d0bb8871668f20de8f3c94b5ae3f372346bc6e",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "2906f66a5682e5670a5eefe991843689b8d8563f",
                            "lessThan": "2f75c0faa3361b28e36cc0512b3299e163e25789",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/netfilter/ipvs/ip_vs_proto_sctp.c"
                    ],
                    "versions": [
                        {
                            "version": "2.6.34",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "2.6.34",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.10.261",
                            "lessThanOrEqual": "5.10.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.212",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.178",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.145",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.97",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.40",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1.5",
                            "lessThanOrEqual": "7.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.2-rc3",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "5.10.261"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "5.15.212"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "6.1.178"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "6.6.145"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "6.12.97"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "6.18.40"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "7.1.5"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "2.6.34",
                                    "versionEndExcluding": "7.2-rc3"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/d2b8b1557ec07ea1bb5dddbceaf4dfe63d388e27"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9f94573ab962a9e81954b755da016fa3cd2f5039"
                },
                {
                    "url": "https://git.kernel.org/stable/c/290e9e8389b556efc603522e28bd1543846aa336"
                },
                {
                    "url": "https://git.kernel.org/stable/c/9cb5ac594ca76d3a71803b23b74c835b0721e628"
                },
                {
                    "url": "https://git.kernel.org/stable/c/a4a2d2e483d79cc2ad3a170674cf159644acf22b"
                },
                {
                    "url": "https://git.kernel.org/stable/c/247d055504dcc852e539b9f7f30d19f9741474bf"
                },
                {
                    "url": "https://git.kernel.org/stable/c/e5d0bb8871668f20de8f3c94b5ae3f372346bc6e"
                },
                {
                    "url": "https://git.kernel.org/stable/c/2f75c0faa3361b28e36cc0512b3299e163e25789"
                }
            ],
            "title": "ipvs: use parsed transport offset in SCTP state lookup",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}