{"cve":"CVE-2026-68477","nvd":{"published":"2026-08-15T06:20:47.440","modified":"2026-10-19T22:17:20.910","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix more places with wrong ipv6 transport offsets\n\nSashiko reports for more incorrect IPv6 transport offsets.\n\nThe app code for TCP was assuming IPv4 network header\neven after the ipvsh argument was provided. This can\ncause problems with apps over IPv6. As for the only\nofficial app in the kernel tree (FTP) this problem is\nharmless because we use Netfilter to mangle the FTP\nports and we do not adjust the TCP seq numbers.\n\nAlso, provide correct offset of the ICMPV6 header in\nip_vs_out_icmp_v6() for correct checksum checks when\nthe IPv6 packet has extension headers.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-20"],"references":["https://git.kernel.org/stable/c/3a9dc9b55b53d94613a587604b77d3b20024090c","https://git.kernel.org/stable/c/613ce63711b8d431bba90781f133c39a21684f87","https://git.kernel.org/stable/c/7350eb7ead172ae8024897d4b0f2e15c5318279c","https://git.kernel.org/stable/c/905d7a363ade96a19f214815361e11981142c547","https://git.kernel.org/stable/c/95d4511d81b2b37e5d2bdde5d912e48243eae517"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-68477","score":0.00714,"percentile":0.53393,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}