CVE-2026-80844

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access issue exists in the AH6 component of the xfrm subsystem. The ipv6 rearrange rthdr() function assumes that the segments left value is not larger than the number of addresses described by the routing header's hdrlen field. This assumption is invalid for raw IPv6 HDRINCL packets, where a packet can have a hdrlen of 2 but an arbitrary segments left value. For example, if segments left is 255, the function moves the address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), leading to memory corruption. This flaw can be exploited by an unprivileged user using user namespaces to achieve local root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.