CVE-2026-80844

A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 (Authentication Header for IPv6) module. The ipv6_rearrange_rthdr() function does not properly validate the segments_left field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacker to craft a malicious packet that can cause an out-of-bounds memory access, potentially leading to memory corruption.

This issue is classified as Important severity because exploitation can be achieved by a local attacker with unprivileged user access. An attack could leverage user namespaces to obtain elevated network permissions within the namespace, then sends specially crafted IPv6 packets with malformed Authentication Header routing headers. Exploitation is challenging but achievable due to complex setup including IPv6 AH/XFRM, ESP-in-UDP encapsulation, and specific timing and memory layout conditions. This memory corruption can enable local privilege escalation to root from an unprivileged user account.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.