Not yet scoredPublished Sep 4, 2026

CVE-2026-80844xfrm: ah6: validate routing header segments_left

Updated under an hour ago (Oct 26, 2026, 10:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2dc650956e4e163b879b3fb1027f9557abc5c985; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 48b0e36cf54358276ee7aa897034c973097d2bc9; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 1b7e066eabcc7d6d8f476c34739b45932f2f4c31; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f00df8500e5a36ba70d336fd34bd2152ea074e5f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1516e31ac458a738be485620579d8f7fb2700fcb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6733ae71268a27d598cfb3f3339a3c950b9b656d; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 builds before 0bf11081ad3753938a2b48723ce6298dbac743a1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 46640c814f25f096b0b0045ca50e1b7030cd8a30; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/2dc650956e4e163b879b3fb1027f9557abc5c985
https://git.kernel.org/stable/c/48b0e36cf54358276ee7aa897034c973097d2bc9
https://git.kernel.org/stable/c/1b7e066eabcc7d6d8f476c34739b45932f2f4c31
https://git.kernel.org/stable/c/f00df8500e5a36ba70d336fd34bd2152ea074e5f
https://git.kernel.org/stable/c/1516e31ac458a738be485620579d8f7fb2700fcb
https://git.kernel.org/stable/c/6733ae71268a27d598cfb3f3339a3c950b9b656d
https://git.kernel.org/stable/c/0bf11081ad3753938a2b48723ce6298dbac743a1
https://git.kernel.org/stable/c/46640c814f25f096b0b0045ca50e1b7030cd8a30
https://git.kernel.org/stable/c/7bad4bda74dc4713f398d3b7624ff05478e3a568

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.