Bug 2528676 (CVE-2026-80844)

Summary:	CVE-2026-80844 kernel: xfrm: ah6: validate routing header segments_left
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, akito5623, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 (Authentication Header for IPv6) module. The `ipv6_rearrange_rthdr()` function does not properly validate the `segments_left` field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacker to craft a malicious packet that can cause an out-of-bounds memory access, potentially leading to memory corruption.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-04 16:23:43 UTC

In the Linux kernel, the following vulnerability has been resolved:

xfrm: ah6: validate routing header segments_left

AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.

That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.

Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.

Comment 1 gkamathe 2026-09-07 12:04:21 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80844.mbox

Comment 4 Akiyoshi Kurita 2026-09-21 08:43:56 UTC

A public local privilege escalation PoC for CVE-2026-80844 (DirtyAH6) has been published.

PoC:
https://github.com/manizada/DirtyAH6

oss-security disclosure:
https://seclists.org/oss-sec/2026/q3/822

Upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7bad4bda74dc4713f398d3b7624ff05478e3a568

The published PoC demonstrates local user-to-root privilege escalation.

Possible mitigation on systems that do not require IPv6:

grubby --update-kernel=ALL --args="ipv6.disable=1"

A reboot is required for this mitigation to take effect.

Please review the affected RHEL kernels and ensure the upstream fix is backported where necessary.

Comment 9 Jon Orris 2026-09-23 18:08:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:71016 https://access.redhat.com/errata/RHSA-2026:71016

Comment 10 Jon Orris 2026-09-24 01:02:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:71213 https://access.redhat.com/errata/RHSA-2026:71213

Comment 11 Jon Orris 2026-09-24 03:01:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:71233 https://access.redhat.com/errata/RHSA-2026:71233

Comment 12 Jon Orris 2026-09-24 05:52:46 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:71232 https://access.redhat.com/errata/RHSA-2026:71232

Comment 13 Jon Orris 2026-09-24 10:34:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:71565 https://access.redhat.com/errata/RHSA-2026:71565

Comment 14 Jon Orris 2026-09-24 11:51:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:71592 https://access.redhat.com/errata/RHSA-2026:71592

Comment 15 Jon Orris 2026-09-24 12:42:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:71594 https://access.redhat.com/errata/RHSA-2026:71594

Comment 16 Jon Orris 2026-09-24 12:54:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:71606 https://access.redhat.com/errata/RHSA-2026:71606

Comment 17 Jon Orris 2026-09-24 13:43:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:71569 https://access.redhat.com/errata/RHSA-2026:71569

Comment 18 Jon Orris 2026-09-24 13:46:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:71601 https://access.redhat.com/errata/RHSA-2026:71601

Comment 19 Jon Orris 2026-09-24 14:17:55 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:71599 https://access.redhat.com/errata/RHSA-2026:71599

Comment 20 Jon Orris 2026-09-24 15:24:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION

Via RHSA-2026:71649 https://access.redhat.com/errata/RHSA-2026:71649

Comment 21 Jon Orris 2026-09-24 16:16:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:71657 https://access.redhat.com/errata/RHSA-2026:71657

Comment 22 Jon Orris 2026-09-24 18:48:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:71631 https://access.redhat.com/errata/RHSA-2026:71631

Comment 23 Jon Orris 2026-09-24 22:30:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:71687 https://access.redhat.com/errata/RHSA-2026:71687

Comment 24 Jon Orris 2026-10-02 15:02:20 UTC

This issue has been addressed in the following products:

  NVIDIA for RHEL 10

Via RHSA-2026:74974 https://access.redhat.com/errata/RHSA-2026:74974

Comment 26 Jon Orris 2026-10-06 12:01:06 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:74428 https://access.redhat.com/errata/RHSA-2026:74428

Comment 27 Jon Orris 2026-10-06 12:32:49 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.21

Via RHSA-2026:74379 https://access.redhat.com/errata/RHSA-2026:74379

Comment 28 Jon Orris 2026-10-06 18:56:28 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.20

Via RHSA-2026:74377 https://access.redhat.com/errata/RHSA-2026:74377

Comment 29 Jon Orris 2026-10-07 10:24:43 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:74433 https://access.redhat.com/errata/RHSA-2026:74433

Comment 30 Jon Orris 2026-10-13 12:40:47 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.21

Via RHSA-2026:79153 https://access.redhat.com/errata/RHSA-2026:79153

Comment 31 Jon Orris 2026-10-15 08:03:05 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2026:79035 https://access.redhat.com/errata/RHSA-2026:79035

Comment 32 Jon Orris 2026-10-15 13:02:23 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2026:77315 https://access.redhat.com/errata/RHSA-2026:77315

Comment 33 Jon Orris 2026-10-15 13:53:22 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2026:77320 https://access.redhat.com/errata/RHSA-2026:77320

Comment 34 Jon Orris 2026-10-15 18:42:25 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2026:77548 https://access.redhat.com/errata/RHSA-2026:77548

Comment 35 Jon Orris 2026-10-15 18:54:14 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2026:77612 https://access.redhat.com/errata/RHSA-2026:77612