CVE-2026-80976: Linux Kernel SRv6 Use-After-Free Vulnerability

CVE-2026-80976 Overview

CVE-2026-80976 is an out-of-bounds read vulnerability in the Linux kernel's Segment Routing over IPv6 (SRv6) implementation. The flaw lives in the seg6 subsystem, specifically in how decap_and_validate() handles the IPv6 control block (IP6CB) after decapsulating an outer SRv6 packet. Stale metadata from the outer packet, including the nhoff next-header offset, is reused when the inner IPv6 packet enters ip6_protocol_deliver_rcu(), causing reads beyond the socket buffer head. An unprivileged user with access to a user and network namespace can install a local Segment Identifier (SID) and reach the vulnerable End.DT6 behavior.

Critical Impact
An unprivileged local user can trigger a kernel out-of-bounds read that may lead to information disclosure, kernel memory corruption, or denial of service.

Affected Products

Linux kernel with SRv6 (seg6) support enabled
Kernel builds exposing End.DX6 and End.DT6 local SID behaviors
Systems permitting unprivileged user namespaces with network namespace creation

Discovery Timeline

2026-09-11 - CVE-2026-80976 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80976

Vulnerability Analysis

The defect resides in the SRv6 receive path. When an outer SRv6 packet arrives, decap_and_validate() pulls the outer headers and promotes the inner packet to become the skb network header. However, IP6CB(skb) retains fields populated while parsing the outer packet, including nhoff and extension-header flags such as Hop-by-Hop and Destination Options.

For End.DX6 and End.DT6 behaviors, the inner IPv6 packet is delivered directly to the IPv6 input path. ip6_protocol_deliver_rcu() then dereferences the stale nhoff value from the outer packet against the inner packet, indexing past the skb head. KASAN reports a slab-out-of-bounds read originating from ip6_protocol_deliver_rcu+0x1118/0x1450, called from seg6_local_input_core via lwtunnel_input and ipv6_rthdr_rcv.

Because the trigger requires only local SID installation and a crafted IPv6 packet, an unprivileged user in a user namespace with CAP_NET_ADMIN inside that namespace can reach the code path without any host privileges.

Root Cause

The root cause is failure to reset per-packet metadata in IP6CB after decapsulation [CWE-125]. The control block conceptually belongs to a single packet, but seg6 reuses it across the outer and inner packets without sanitization. The stale nhoff value points into memory that is valid for the outer header layout but invalid for the shorter inner packet.

Attack Vector

An attacker crafts an outer IPv6 packet containing a Hop-by-Hop header, a Destination Options header, an SRH, and a minimal inner IPv6 packet. The extension headers inflate nhoff in IP6CB. Once End.DT6 decapsulates the packet, the inner packet enters the IPv6 delivery path with the inflated offset, and the kernel reads beyond the skb head. See the upstream fixes for the full patch series, including Kernel Commit 2b154e96 and Kernel Commit f967455f.

Detection Methods for CVE-2026-80976

Indicators of Compromise

KASAN slab-out-of-bounds reports referencing ip6_protocol_deliver_rcu, seg6_local_input_core, or ipv6_rthdr_rcv in kernel logs
Unexpected kernel oops or soft lockups on hosts with SRv6 lightweight tunnels configured
Creation of local SIDs of type End.DX6 or End.DT6 by non-administrative processes inside user namespaces

Detection Strategies

Audit kernel logs (dmesg, journalctl -k) for KASAN traces or IPv6 delivery faults tied to the seg6_local code path
Inventory hosts where CONFIG_IPV6_SEG6_LWTUNNEL is enabled and correlate with kernel versions predating the fix commits
Monitor ip -6 route and netlink activity for unprivileged installation of SRv6 local SIDs inside containers

Monitoring Recommendations

Enable auditd rules on setsockopt, RTM_NEWROUTE, and namespace syscalls (unshare, clone with CLONE_NEWUSER|CLONE_NEWNET)
Alert on any process spawning inside a container that manipulates lightweight tunnel encapsulation attributes
Forward kernel ring buffer events to a centralized log platform for cross-host correlation of KASAN or BUG entries

How to Mitigate CVE-2026-80976

Immediate Actions Required

Apply the upstream kernel patches from the stable tree once vendor packages are available
Disable unprivileged user namespaces on hosts that do not require them by setting kernel.unprivileged_userns_clone=0
Restrict container workloads that require CAP_NET_ADMIN and inspect them for SRv6 usage

Patch Information

The fix saves the incoming interface index (IP6CB(skb)->iif) and the IP6SKB_L3SLAVE flag before clearing IP6CB, restores both after the clear, and sets nhoff to the inner IPv6 base-header nexthdr field. IP6CB(skb)->iif is used instead of skb->skb_iif because VRF processing can replace skb_iif with the L3 master. Backports are available across stable branches via Kernel Commit 96c74420, Kernel Commit 9ae92198, Kernel Commit a0e2b0a3, Kernel Commit c73fb911, Kernel Commit cfa186a0, and Kernel Commit d1f0d353.

Workarounds

Blacklist or unload the seg6 and seg6_iptunnel kernel modules on hosts that do not use SRv6
Disable SRv6 processing at runtime by setting net.ipv6.conf.all.seg6_enabled=0 and per-interface equivalents
Prevent unprivileged namespace creation using sysctl hardening or seccomp policies applied to container runtimes

bash

# Configuration example
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w net.ipv6.conf.all.seg6_enabled=0
sysctl -w net.ipv6.conf.default.seg6_enabled=0
echo 'blacklist seg6_iptunnel' >> /etc/modprobe.d/seg6-blacklist.conf