Loading vulnerability…
Out-of-bounds memory access in Linux kernel XFRM AH6 routing-header processing
CVE-2026-80844 is an out-of-bounds memory access vulnerability in the Linux kernel's XFRM IPv6 Authentication Header (AH6) processing. AH6 rearranges routing-header addresses before computing or verifying the integrity check value. The ipv6_rearrange_rthdr() function assumes that segments_left does not exceed the address count derived from hdrlen, but crafted raw IPv6 HDRINCL packets can violate this invariant. With hdrlen set to 2 and segments_left set to 255, the function moves its address pointer 4,064 bytes backward and invokes memmove() with a 4,064-byte length, accessing memory outside the intended bounds. This can cause kernel memory corruption or a system crash.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malformed packet processing can cause out-of-bounds kernel memory access, potentially resulting in memory corruption and denial of service through a kernel crash. Potential local privilege-escalation use has also been identified, but successful privilege escalation and its precise exploitation conditions are not established.
If you can’t patch tonight, do this now.
Until patched, restrict untrusted users and workloads from creating raw IPv6 HDRINCL packets, including limiting access to raw-socket capabilities. Where operationally feasible, disable or restrict unnecessary IPv6 IPsec AH or raw-packet functionality. Filter untrusted IPv6 routing-header traffic where relevant to the deployed AH6 processing paths; filtering alone does not address locally generated malicious packets.
Patch, then assume compromise.
Install a distribution-supported kernel update containing the AH6 routing-header validation fix and activate the corrected kernel by rebooting, or apply an applicable vendor-supported live patch. The fix checks segments_left against the routing-header address count before modifying the header or performing pointer arithmetic, and propagates malformed-header errors through existing AH6 input and output error paths. Identified fixed packages include Debian bookworm kernel version 6.1.187-1 or later and Bottlerocket kernel branch updates 6.1.186, 6.12.103, and 6.18.48. Use the update appropriate to the installed distribution and kernel branch.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.