Linux Kernel CVE-2026-72021

IPVS is a Layer-4 load balancing subsystem built into the Linux kernel, commonly used through LVS and as the kube-proxy backend in Kubernetes clusters. It maintains per-connection state tables - including for SCTP - to route packets correctly across backend real servers. For IPv6, the proper transport-layer offset is determined by ipv6_find_hdr() inside ip_vs_fill_iph_skb(), which iterates through all extension headers (Routing, Destination Options, Hop-by-Hop, etc.) to find the actual SCTP chunk. The bug is in set_sctp_state(): it independently recomputes the offset using the fixed sizeof(struct ipv6hdr) = 40 bytes, ignoring any extension headers. For a packet with an 8-byte Destination Options header, this puts the read pointer 8 bytes early, landing inside the SCTP verification tag rather than the chunk type field. The chunk type byte read is therefore incorrect, causing the state machine to transition NONE→ESTABLISHED instead of NONE→INIT1. This assigns the longer established connection timeout and incorrectly increments the active destination counter, skewing load balancer weight-based scheduling. CWE classification is not assigned in the NVD record; the root cause is an off-by-N offset computation error (functionally similar to CWE-193: Off-by-one Error or CWE-682: Incorrect Calculation).