CVE-2026-80844

xfrm: ah6: validate routing header segments_left

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: ah6: validate routing header segments_left

AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field.

That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access.

Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2dc650956e4e163b879b3fb1027f9557abc5c985Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 48b0e36cf54358276ee7aa897034c973097d2bc9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1b7e066eabcc7d6d8f476c34739b45932f2f4c31Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f00df8500e5a36ba70d336fd34bd2152ea074e5fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1516e31ac458a738be485620579d8f7fb2700fcbAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6733ae71268a27d598cfb3f3339a3c950b9b656dAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0bf11081ad3753938a2b48723ce6298dbac743a1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 46640c814f25f096b0b0045ca50e1b7030cd8a30Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7bad4bda74dc4713f398d3b7624ff05478e3a568Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.269 through 5.10.Not affected 5.15.220 through 5.15.Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.1.13 through 7.1.Not affected 7.2.3 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2dc650956e4e163b879b3fb1027f9557abc5c985Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 48b0e36cf54358276ee7aa897034c973097d2bc9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1b7e066eabcc7d6d8f476c34739b45932f2f4c31Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f00df8500e5a36ba70d336fd34bd2152ea074e5fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1516e31ac458a738be485620579d8f7fb2700fcbAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6733ae71268a27d598cfb3f3339a3c950b9b656dAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0bf11081ad3753938a2b48723ce6298dbac743a1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 46640c814f25f096b0b0045ca50e1b7030cd8a30Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7bad4bda74dc4713f398d3b7624ff05478e3a568Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.269 through 5.10.*Not affected
5.15.220 through 5.15.*Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.1.13 through 7.1.*Not affected
7.2.3 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.