CVE-2026-80844: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-80844 Overview

CVE-2026-80844 is a Linux kernel vulnerability in the IPv6 Authentication Header (AH6) implementation within the xfrm subsystem. The flaw resides in ipv6_rearrange_rthdr(), which rearranges routing-header addresses before computing or verifying the Integrity Check Value (ICV). The function assumes that the segments_left field never exceeds the number of addresses described by the routing header's hdrlen field. Raw IPv6 packets sent with the HDRINCL socket option break this invariant, allowing a crafted packet to trigger an out-of-bounds memory access inside the kernel.

Critical Impact
A local attacker sending crafted raw IPv6 HDRINCL packets can trigger an out-of-bounds memmove() of up to 4,064 bytes in kernel memory, leading to memory corruption or denial of service.

Affected Products

Linux kernel (upstream mainline, prior to the fixing commits)
Multiple Linux stable kernel branches receiving the backported fix
Distributions shipping the Linux kernel with IPv6 AH (xfrm) support enabled

Discovery Timeline

2026-09-04 - CVE-2026-80844 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80844

Vulnerability Analysis

The defect is an out-of-bounds read/write in the IPv6 routing header rearrangement logic used by AH6. When AH6 processes an outbound or inbound packet carrying a Type 0 routing header, it calls ipv6_rearrange_rthdr() to normalize address ordering so the ICV can be computed deterministically. The function walks the address array using segments_left as an index and uses memmove() to shift addresses in place.

The routing header's hdrlen field defines how many 8-byte units follow, and therefore how many IPv6 addresses the header describes. Normal kernel-generated packets keep segments_left bounded by that count. Raw sockets opened with IPPROTO_RAW and the HDRINCL option let user space supply the full IPv6 header chain, including arbitrary segments_left values that violate this invariant.

With hdrlen = 2 (one address) and segments_left = 255, the address pointer is moved 4,064 bytes backwards. A subsequent memmove() of 4,064 bytes then reads and writes memory well outside the packet buffer, producing kernel memory corruption. The class of defect corresponds to an out-of-bounds write [CWE-787] triggered by improper input validation [CWE-20].

Root Cause

The root cause is a missing invariant check between the routing header's hdrlen and segments_left fields before pointer arithmetic. ipv6_rearrange_rthdr() trusts values that originate from a raw user-supplied header. Without validation, segments_left can index far past the actual address array embedded in the packet.

Attack Vector

Exploitation requires the ability to open an AF_INET6 raw socket with IPPROTO_RAW and to send packets whose IPv6 header chain includes a Type 0 routing header with an inconsistent segments_left value. On most distributions, raw socket creation requires CAP_NET_RAW, restricting the attack surface to local privileged contexts, containers granted that capability, or code paths that expose raw sockets to lesser-privileged users. The AH6 transform must be active on the outbound or inbound path for the vulnerable code to execute.

The fix validates the hdrlen versus segments_left invariant locally before any pointer arithmetic and routes malformed-header errors through the existing AH6 input and output error paths. See the upstream fix commits, including Kernel Stable Commit 0bf1108 and Kernel Stable Commit 1516e31, for the exact change.

Detection Methods for CVE-2026-80844

Indicators of Compromise

Kernel oops or panic messages referencing ipv6_rearrange_rthdr, ah6_output, or ah6_input in dmesg or /var/log/kern.log.
KASAN reports flagging out-of-bounds access inside ipv6_rearrange_rthdr() when running instrumented kernels.
Unexpected process termination or node reboots correlated with IPsec AH-protected IPv6 traffic.

Detection Strategies

Audit running kernel versions against the fixing commits listed on the kernel.org stable tree to identify unpatched hosts.
Monitor for processes that create AF_INET6 raw sockets with IPPROTO_RAW, especially in containers or workloads that should not require CAP_NET_RAW.
Alert on repeated kernel crashes on hosts where IPv6 IPsec AH transforms are configured.

Monitoring Recommendations

Enable and forward auditd rules for socket() syscalls with AF_INET6 and SOCK_RAW to a central log store for review.
Ingest kernel ring-buffer logs into a SIEM and alert on strings such as BUG:, KASAN, slab-out-of-bounds, and ipv6_rearrange_rthdr.
Track capability grants (CAP_NET_RAW) in container orchestration platforms and flag pods or workloads that request it unnecessarily.

How to Mitigate CVE-2026-80844

Immediate Actions Required

Update to a Linux kernel release that includes one of the upstream fixing commits referenced by kernel.org for this CVE.
Restrict CAP_NET_RAW on multi-tenant hosts and container platforms to prevent unprivileged workloads from opening raw IPv6 sockets.
Review IPsec configurations and disable AH for IPv6 flows where ESP alone is sufficient until patched kernels are deployed.

Patch Information

The fix validates the routing header invariant before modifying header contents and propagates errors through the existing AH6 input and output paths. Distribution kernels should pick up the change from the stable tree commits, including 0bf11081, 1516e31a, 1b7e066e, 2dc65095, 46640c81, 48b0e36c, 6733ae71, 7bad4bda, and f00df850. Apply vendor-supplied kernel updates rather than cherry-picking commits where possible.

Workarounds

Remove CAP_NET_RAW from non-essential users, containers, and service accounts to block raw IPv6 socket creation.
Disable IPv6 AH transforms in the local IPsec policy where operationally feasible until the kernel patch is deployed.
Where IPv6 is not required, disable it at the kernel or interface level to eliminate the vulnerable code path.

bash

# Configuration example: drop CAP_NET_RAW for a systemd service
# /etc/systemd/system/<service>.service.d/override.conf
[Service]
CapabilityBoundingSet=~CAP_NET_RAW
AmbientCapabilities=
NoNewPrivileges=yes