CVE-2026-80844

xfrm: ah6: validate routing header segments_left

No known exploitation. EPSS puts it in the 35th percentile. No fix published yet.

CVSS —Not scored EPSS percentile35th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-04Updated 2026-09-04Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Ask IT whether your linux kernel systems process IPv6 traffic with Authentication Header protection enabled and accept raw IPv6 packets with Routing Headers through IP-in-IPv6.
Install your operating-system vendor's kernel update containing the fix; the supplied findings identify fixes by commits, not numbered releases: 2dc650956e4e163b879b3fb1027f9557abc5c985, 48b0e36cf54358276ee7aa897034c973097d2bc9, 1b7e066eabcc7d6d8f476c34739b45932f2f4c31, f00df8500e5a36ba70d336fd34bd2152ea074e5f, 1516e31ac458a738be485620579d8f7fb2700fcb, 6733ae71268a27d598cfb3f3339a3c950b9b656d, 0bf11081ad3753938a2b48723ce6298dbac743a1, 46640c814f25f096b0b0045ca50e1b7030cd8a30, or 7bad4bda74dc4713f398d3b7624ff05478e3a568.
Until updated, restrict untrusted IPv6 traffic to affected systems and disable the affected protection configuration where doing so is operationally acceptable.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

In plain language

Written by AI from the record

This linux kernel flaw can let specially crafted IPv6 traffic read unintended memory or crash a system, so businesses using the affected network setup should act urgently.

Unauthenticated network-triggered out-of-bounds read in linux kernel AH6 routing-header handling when `segments_left` exceeds the address count declared by the IPv6 routing header.

If you're affected

System crash
Sensitive memory disclosure
Network-service disruption

What is it

This is a flaw in how a computer handles a malformed kind of internet traffic. It is like a delivery list that claims it contains far more addresses than it actually does, causing the system to look beyond the list and potentially expose information or stop working.

Who is affected

This matters to you if you run linux kernel systems, such as Linux servers, appliances, or network gateways. It is only a risk if the system processes IPv6 traffic with Authentication Header protection enabled and accepts raw IPv6 packets containing Routing Headers through IP-in-IPv6.

How urgent is it

Attackers can remotely send specially formed network traffic that may make an affected system read unintended memory or crash. Treat this as urgent because it is reachable in the default configuration when the stated IPv6 and protection conditions are present, although no confirmed real-world exploitation is reported.

What to do — in detail

Confirm exposure by identifying linux kernel hosts that process IPv6 traffic, have AH/xfrm protection enabled, and accept raw IPv6 HDRINCL packets with Routing Headers inserted using IP-in-IPv6. The findings do not provide numbered release versions or branch-to-fix mappings; obtain the vendor kernel update that incorporates the applicable upstream fix commit: 2dc650956e4e163b879b3fb1027f9557abc5c985, 48b0e36cf54358276ee7aa897034c973097d2bc9, 1b7e066eabcc7d6d8f476c34739b45932f2f4c31, f00df8500e5a36ba70d336fd34bd2152ea074e5f, 1516e31ac458a738be485620579d8f7fb2700fcb, 6733ae71268a27d598cfb3f3339a3c950b9b656d, 0bf11081ad3753938a2b48723ce6298dbac743a1, 46640c814f25f096b0b0045ca50e1b7030cd8a30, or 7bad4bda74dc4713f398d3b7624ff05478e3a568. Apply the vendor-supported kernel update and reboot into it; no upgrade-breaking-change information is provided. If patching is delayed, filter untrusted IPv6 traffic to affected hosts and disable AH protection or raw IPv6 Routing Header handling where feasible. No CISA KEV due date applies because this CVE is not listed in KEV. Monitor for malformed IPv6 routing-header traffic and unexpected kernel or network-service crashes.

Technical context

Severity was not provided in the findings. The issue is an out-of-bounds memory read in AH6 routing-header address rearrangement: a crafted IPv6 Routing Header can set segments_left above the address count represented by hdrlen, causing invalid pointer arithmetic and an out-of-bounds memmove(). Attack vector is network, authentication and user interaction are not required, and the relevant configuration is reachable by default when IPv6 AH protection and raw IPv6 HDRINCL Routing Header handling are enabled. CISA KEV does not list this CVE, no public exploit code is recorded, and no clear dated press claim confirms exploitation. EPSS is 0.2% at the 10th percentile with a flat trend; this is predictive only, not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS35th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 35th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

3 events over 6 days, from the signal feeds we watch.

2026-09-10OpenVAS check added
2026-09-04Publishedrecord updated

Affected products

Linuxoss-projectaka the linux kernel
- LinuxOSOn-premOperating Systems / linux-distro

Sources

References in the record

And 6 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account