{"id":"CVE-2026-80844","title":"xfrm: ah6: validate routing header segments_left","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: ah6: validate routing header segments_left\n\nAH6 rearranges routing-header addresses before computing or verifying the\nICV. ipv6_rearrange_rthdr() assumes that seg…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2dc650956e4e163b879b3fb1027f9557abc5c985","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 48b0e36cf54358276ee7aa897034c973097d2bc9","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1b7e066eabcc7d6d8f476c34739b45932f2f4c31","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f00df8500e5a36ba70d336fd34bd2152ea074e5f","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1516e31ac458a738be485620579d8f7fb2700fcb","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6733ae71268a27d598cfb3f3339a3c950b9b656d","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0bf11081ad3753938a2b48723ce6298dbac743a1","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 46640c814f25f096b0b0045ca50e1b7030cd8a30","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7bad4bda74dc4713f398d3b7624ff05478e3a568","Linux 2.6.12"],"exploitAvailable":true,"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:44:37.342Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80844","references":[{"url":"https://git.kernel.org/stable/c/2dc650956e4e163b879b3fb1027f9557abc5c985"},{"url":"https://git.kernel.org/stable/c/48b0e36cf54358276ee7aa897034c973097d2bc9"},{"url":"https://git.kernel.org/stable/c/1b7e066eabcc7d6d8f476c34739b45932f2f4c31"},{"url":"https://git.kernel.org/stable/c/f00df8500e5a36ba70d336fd34bd2152ea074e5f"},{"url":"https://git.kernel.org/stable/c/1516e31ac458a738be485620579d8f7fb2700fcb"},{"url":"https://git.kernel.org/stable/c/6733ae71268a27d598cfb3f3339a3c950b9b656d"},{"url":"https://git.kernel.org/stable/c/0bf11081ad3753938a2b48723ce6298dbac743a1"},{"url":"https://git.kernel.org/stable/c/46640c814f25f096b0b0045ca50e1b7030cd8a30"},{"url":"https://git.kernel.org/stable/c/7bad4bda74dc4713f398d3b7624ff05478e3a568"}],"tags":["cve.org","exploit-available"],"epss":0.00434,"epssPercentile":0.36202,"exploits":{"github":3,"githubRepos":["https://github.com/suominen/dirtyah6","https://github.com/0xBlackash/CVE-2026-80844","https://github.com/HORKimhab/CVE-2026-80844"],"checkedAt":"2026-10-19T09:16:36.569Z"},"ingestedAt":"2026-10-19T09:16:01.497Z","slug":"CVE-2026-80844","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: ah6: validate routing header segments_left\n\nAH6 rearranges routing-header addresses before computing or verifying the\nICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than\nthe number of addresses described by the routing header's hdrlen field.\n\nThat assumption does not hold for raw IPv6 HDRINCL packets. A packet with\nhdrlen equal to 2 describes one address, but can carry an arbitrary\nsegments_left value. With segments_left equal to 255, the function moves\nits address pointer 4,064 bytes backwards and passes a 4,064-byte length to\nmemmove(), resulting in an out-of-bounds access.\n\nValidate the invariant locally before modifying the routing header or\nperforming any address-pointer arithmetic, and propagate malformed-header\nerrors to the existing AH6 input and output error paths.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2dc650956e4e163b879b3fb1027f9557abc5c985`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 48b0e36cf54358276ee7aa897034c973097d2bc9`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1b7e066eabcc7d6d8f476c34739b45932f2f4c31`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f00df8500e5a36ba70d336fd34bd2152ea074e5f`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1516e31ac458a738be485620579d8f7fb2700fcb`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6733ae71268a27d598cfb3f3339a3c950b9b656d`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0bf11081ad3753938a2b48723ce6298dbac743a1`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 46640c814f25f096b0b0045ca50e1b7030cd8a30`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7bad4bda74dc4713f398d3b7624ff05478e3a568`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}