CVE-2026-80976

A flaw was found in the Linux kernel's IPv6 Segment Routing (seg6) implementation. An unprivileged user can exploit this vulnerability by injecting a specially crafted IPv6 packet. This can lead to an out-of-bounds read, potentially causing a system crash and resulting in a Denial of Service (DoS).

A stale IPv6 control block after SRv6 decapsulation can leave IP6CB nhoff and extension header state from the outer packet attached to the inner IPv6 packet. When End.DX6 or End.DT6 sends the inner packet into the IPv6 input path, ip6_protocol_deliver_rcu may use the stale offset and read beyond the skb head, which is reported as a KASAN slab out of bounds read. For the CVSS the PR:N is used in the paranoid network scenario because a preconfigured SRv6 endpoint may process a crafted packet without requiring an account on the victim. The base local scenario needs a local user able to use user and net namespaces to install a local SID and inject the crafted outer packet. The issue is potentially network reachable when SRv6 local processing is exposed, but SRv6 is commonly limited to controlled operator or data center networks. Impact is at least denial of service via kernel crash, with possible low confidentiality or integrity concern from an out of bounds read but no proven write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.