CVE-2026-80844
Received Received - Intake

Linux Kernel IPv6 AH6 Routing Header Validation Flaw

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80844
EUVD
EUVD-2026-71294

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the AH6 (Authentication Header for IPv6) implementation. When processing IPv6 packets with routing headers, the code incorrectly assumes that the segments_left field in the routing header cannot exceed the number of addresses specified by the hdrlen field. This allows an attacker to craft a malicious packet with a large segments_left value, causing the kernel to access memory out of bounds when rearranging routing header addresses.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by crashing the system or potentially execute arbitrary code with kernel privileges. It affects systems using IPv6 with AH6, particularly those handling raw IPv6 HDRINCL packets. Successful exploitation may lead to system instability or unauthorized access.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates addressing CVE-2026-80844.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80844. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart