CVE-2026-80840

A flaw was found in the Linux kernel's IPv6 Segment Routing over IPv6 (SRv6) implementation. A remote attacker can exploit this vulnerability by sending specially crafted IPv6 packets that are then decapsulated as IPv4 packets. Due to improper handling of data during this process, the system attempts to write beyond allocated memory, leading to a heap out-of-bounds write. This can cause a denial of service, making the system unavailable, and potentially lead to other unpredictable system behavior.

This vulnerability is rated Important rather than Moderate because an out-of-bounds heap write in kernel space can lead to a system crash or potential privilege escalation. However, standard Red Hat Enterprise Linux installations do not configure IPv6 Segment Routing decapsulation behaviors by default. Impact is limited to systems explicitly operating as SRv6 endpoints with active IPv4-in-IPv6 decapsulation rules.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.