CVE-2026-118593

The record

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

Affected packages

Related vulnerabilities

• CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. CWE-667
• CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6… CWE-667
• CVE-2026-110803 VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the… CWE-667
• CVE-2026-111879 DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a… CWE-667
• CVE-2026-107674 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate… CWE-667
• CVE-2026-98123 In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup… CWE-667
• CVE-2026-98094 In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make… CWE-667
• CVE-2026-45404 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-667