CVE-2026-89783

A flaw was found in the Linux kernel's IPv6 networking component. An error in handling security path depth could allow an out-of-bounds write. A remote attacker could exploit this by sending specially crafted IPv6 packets, leading to a system crash and causing a Denial of Service (DoS).

A flaw of Moderate impact was found in the Linux kernel's IPv6 XFRM input processing. The depth check in xfrm6_input_addr() is off by one: when a transport-mode receive path re-enters IPv6 input via xfrm_trans_reinject() with a security path (secpath) that is already full, and the inner IPv6 packet carries a destination-options Home Address (HAO) option or a type-2 routing header, the function writes one pointer past the end of the six-element xvec array. A remote attacker could exploit this flaw by sending specially crafted IPv6 packets to an affected system, causing a kernel panic and resulting in a denial of service; on systems with panic_on_warn enabled, the out-of-bounds access triggers a UBSAN array-index-out-of-bounds report and a subsequent panic. Red Hat Product Security assesses this flaw as Moderate, lower than the Critical severity assigned in the upstream CVE record (CVSS 9.8), because triggering the out-of-bounds write requires a highly specific crafted IPv6 packet structure, the write stays within the surrounding sec_path allocation, and the demonstrated consequence is a system crash rather than exposure of sensitive data. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift Container Platform are affected, and fixes are being pursued for these products. Red Hat Enterprise Linux 6 is out of support scope for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.