CVE-2026-80840: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80840 Overview

CVE-2026-80840 is a Linux kernel vulnerability in the IPv6 Segment Routing (SRv6) subsystem. The flaw affects End.DX4, End.DT4, and End.DT46 SRv6 behaviors during IPIP decapsulation. The kernel fails to clear the IPv4 control block (IPCB) after decapsulating an inner IPv4 packet, leaving stale IP6CB data in the shared skb->cb storage. An attacker sending a crafted IPv6 packet with extension headers can trigger a slab out-of-bounds write of up to 255 bytes inside __ip_options_echo() on the TCP SYN receive path.

Critical Impact
Remote attackers can trigger a slab out-of-bounds write in kernel memory by sending crafted SRv6 packets to hosts configured with End.DX4, End.DT4, or End.DT46 behaviors, enabling potential kernel memory corruption.

Affected Products

Linux kernel builds with CONFIG_IPV6_SEG6_LWTUNNEL enabled and SRv6 End.DX4, End.DT4, or End.DT46 behaviors configured
Reproduced on Linux kernel v7.2-rc5 (little-endian x86-64)
Multiple upstream stable branches fixed via commits 0e3f01fe, 10fd1a8f, 3e4476e5, 44930446, 9039e4f3, bf1c1151, eb0f4224, f4be3b39, and f52f1e75

Discovery Timeline

2026-09-04 - CVE-2026-80840 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80840

Vulnerability Analysis

The vulnerability is a kernel out-of-bounds write triggered through the IPv6 Segment Routing Header (SRH) processing path. End.DX4 and End.DT4 behaviors decapsulate an inner IPv4 packet via decap_and_validate() and send it directly into IPv4 routing. This path bypasses ip_rcv_core(), which is the function that normally clears IPCB before IPv4 code reads skb->cb.

Because IP6CB and IPCB share the same skb->cb storage, fields overlap in memory. IP6CB(skb)->lastopt overlaps IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and ts. IPv4 code therefore interprets stale IPv6 metadata as IP options state.

Root Cause

The root cause is missing initialization of the IPv4 control block after SRv6 IPIP decapsulation. When a sender places an eight-byte Destination Options header between the IPv6 header and the SRH, ipv6_destopt_rcv() records the sender-controlled offset in both lastopt and nhoff, setting them to 40. On the reproduced x86-64 kernel, IPv4 then observes optlen = 40 and rr = 40.

Attack Vector

On the TCP SYN path, tcp_v4_save_options() and __ip_options_echo() skip option copying only when optlen is zero. With optlen = 40, the SYN handler allocates 40 bytes for option data and calls __ip_options_echo(). The stale rr value causes the function to read inner packet byte 41 as the Record Route option length. When that byte is 255, __ip_options_echo() writes 255 bytes into the 40-byte destination, producing a KASAN slab-out-of-bounds write reported through tcp_v4_route_req → tcp_conn_request → tcp_v4_rcv → ip_local_deliver → input_action_end_dx4 (or input_action_end_dt4).

No verified public exploit code is available. The vulnerability is described in prose based on the upstream commit message. See the Kernel.org fix commit for the authoritative technical details.

Detection Methods for CVE-2026-80840

Indicators of Compromise

KASAN reports containing BUG: KASAN: slab-out-of-bounds in __ip_options_echo() with a write size larger than the allocated option area
Kernel stack traces referencing input_action_end_dx4, input_action_end_dx4_finish, or input_action_end_dt4 combined with tcp_v4_conn_request
Unexpected TCP SYN traffic arriving inside SRv6-encapsulated IPv6 packets on interfaces bound to SRv6 endpoint behaviors

Detection Strategies

Inspect IPv6 traffic for SRH packets addressed to configured End.DX4, End.DT4, or End.DT46 SIDs and correlate with inner IPv4 TCP SYN payloads carrying non-zero option data
Enable KASAN or KFENCE in test environments to catch the out-of-bounds write during fuzzing of SRv6 behaviors
Monitor kernel logs for slab corruption warnings, general protection faults, or oops events on SRv6-enabled routers

Monitoring Recommendations

Ingest kernel dmesg and journald output into a centralized log platform and alert on KASAN, slab-out-of-bounds, or __ip_options_echo strings
Capture NetFlow or packet samples at SRv6 ingress points to profile the expected shape of encapsulated IPv4 traffic and flag anomalies
Track kernel version inventory across hosts to identify systems still running unpatched builds with CONFIG_IPV6_SEG6_LWTUNNEL enabled

How to Mitigate CVE-2026-80840

Immediate Actions Required

Apply the upstream kernel fix that clears IPCB in the common SRv6 decapsulation path and restores the ingress interface from IP6CB(skb)->iif
Upgrade Linux kernels on all hosts terminating SRv6 endpoint behaviors to a version containing the fix commits listed in the references
On hosts that do not require SRv6, disable CONFIG_IPV6_SEG6_LWTUNNEL or remove End.DX4, End.DT4, and End.DT46 route configurations

Patch Information

The upstream fix modifies decap_and_validate() to save the ingress interface from IP6CB, clear IPCB, and restore the saved value when handling IPPROTO_IPIP. This single change covers End.DX4, End.DT4, and the IPv4 arm of End.DT46. Distribution kernels should pick up the backports referenced by commits f52f1e75, 0e3f01fe, 10fd1a8f, 3e4476e5, 44930446, 9039e4f3, bf1c1151, eb0f4224, and f4be3b39.

Workarounds

Remove SRv6 endpoint routes that decapsulate IPv4 (End.DX4, End.DT4, End.DT46) until the patched kernel is deployed
Filter untrusted IPv6 traffic containing Destination Options headers preceding an SRH at the network edge
Restrict SRv6 SID address space to trusted internal peers using ingress ACLs on border routers and hosts

bash

# Remove SRv6 IPv4 decapsulation routes as a temporary workaround
ip -6 route show encap seg6local | grep -E 'End.DX4|End.DT4|End.DT46'
ip -6 route del <SID>/128 encap seg6local action End.DX4 nh4 <nexthop> dev <iface>

# Verify kernel version after patching
uname -r