CVE-2026-80840

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2

Description An issue exists in the IPv6 Segment Routing (seg6) implementation during IPIP decapsulation. When End.DX4 and End.DT4 decapsulate an IPv4 packet via the decap and validate() function, the packet is sent directly to IPv4 routing, bypassing ip rcv core(). This bypass prevents the clearing of the IPv4 control block (IPCB), causing the socket buffer (skb) to retain stale IP6CB data from the outer packet.

Because IP6CB and IPCB share the same skb->cb storage, a sender can manipulate the lastopt and nhoff values using a valid outer extension-header chain. This can lead to a situation where the optlen is interpreted as non-zero, causing the TCP SYN path to allocate a small buffer for option data. Subsequently, the ip options echo() function may read a sender-controlled byte as the Record Route option length, leading to a slab-out-of-bounds write where more data is copied into the buffer than was allocated.

Recommendations Update the Linux kernel to version 7.2 or later. As a temporary mitigation, restrict the use of the decap and validate() function when handling IPPROTO IPIP traffic.