Cloudanix VulnDB

CVE-2026-80844

None

CVSS

—

EPSS

0.4%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain network packets could let an attacker crash the system or run harmful code by sending specially crafted internet traffic.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds memory access in ipv6_rearrange_rthdr() triggered when segments_left exceeds the address count implied by hdrlen in IPv6 routing headers processed by AH6 for raw HDRINCL packets, allowing arbitrary backward pointer movement and oversized memmove operations.

Why it matters to the business

Kernel memory corruption on systems handling crafted IPv6 packets can cause crashes, service disruption, or potential code execution; affects Red Hat Enterprise Linux kernels across multiple releases with fixes available in specific updated packages.

How an attack unfolds

An attacker crafts an IPv6 packet containing an AH header and a routing header where hdrlen indicates few addresses but segments_left is set to a large value such as 255; the kernel's assumption violation during AH6 ICV processing leads to invalid address pointer arithmetic and out-of-bounds access.

How to fix it

Upgrade affected Red Hat kernels to the fixed versions: kernel el10 to 6.12.0-55.107.1.el10_0, el6 to 2.6.32-754.63.1.el6, el7 to 3.10.0-1160.164.1.el7, el8 to 4.18.0-553.167.1.el8_10, el9 to 5.14.0-570.144.1.el9_6; kernel-rt equivalents similarly updated per RHSA-2026:71592.

How to confirm the fix worked

Verify running kernel version matches or exceeds the listed fixed packages for the distribution release; test with crafted IPv6 routing header packets to confirm error propagation on malformed headers.

Typical attack path

  1. Send raw IPv6 packet with AH and manipulated routing header via HDRINCL socket
  2. Trigger ipv6_rearrange_rthdr() with segments_left larger than hdrlen-described addresses
  3. Cause out-of-bounds pointer adjustment and oversized memory operation
  4. Achieve memory corruption for denial of service or further exploitation

How to detect it

Review kernel logs for AH6 input/output error paths triggered by malformed routing headers; inspect network traffic for IPv6 packets with AH and routing headers exhibiting segments_left larger than hdrlen-implied addresses.

What your security team should do

  • Apply the listed kernel updates immediately on all affected Red Hat systems
  • Monitor EPSS and exploit maturity indicators for any increase in risk
  • Restrict raw IPv6 HDRINCL socket usage where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

Affected packages

Ecosystem Package Introduced Fixed