CVE-2026-77206

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.

Red Hat Product Security rates this vulnerability as having a Moderate impact. Exploitation requires Libreswan to be running as an IKEv2 endpoint, a configuration that requires explicit installation and service configuration on a standard Red Hat Enterprise Linux system. A remote, unauthenticated attacker can send a crafted IKEv2 authentication packet to crash the pluto daemon, potentially disrupting VPN connectivity. Repeated exploitation can cause continued denial of service. Remote code execution is not possible.

The vulnerability can be triggered even when EAP is not configured.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.