CVE-2026-80844xfrm: ah6: validate routing header segments_left
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2dc650956e4e163b879b3fb1027f9557abc5c985; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 48b0e36cf54358276ee7aa897034c973097d2bc9; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1b7e066eabcc7d6d8f476c34739b45932f2f4c31; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f00df8500e5a36ba70d336fd34bd2152ea074e5f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1516e31ac458a738be485620579d8f7fb2700fcb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6733ae71268a27d598cfb3f3339a3c950b9b656d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 0bf11081ad3753938a2b48723ce6298dbac743a1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 46640c814f25f096b0b0045ca50e1b7030cd8a30; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/2dc650956e4e163b879b3fb1027f9557abc5c985
- https://git.kernel.org/stable/c/48b0e36cf54358276ee7aa897034c973097d2bc9
- https://git.kernel.org/stable/c/1b7e066eabcc7d6d8f476c34739b45932f2f4c31
- https://git.kernel.org/stable/c/f00df8500e5a36ba70d336fd34bd2152ea074e5f
- https://git.kernel.org/stable/c/1516e31ac458a738be485620579d8f7fb2700fcb
- https://git.kernel.org/stable/c/6733ae71268a27d598cfb3f3339a3c950b9b656d
- https://git.kernel.org/stable/c/0bf11081ad3753938a2b48723ce6298dbac743a1
- https://git.kernel.org/stable/c/46640c814f25f096b0b0045ca50e1b7030cd8a30
- https://git.kernel.org/stable/c/7bad4bda74dc4713f398d3b7624ff05478e3a568
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.