Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
Upstream advisory: https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80844.mbox
A public local privilege escalation PoC for CVE-2026-80844 (DirtyAH6) has been published. PoC: https://github.com/manizada/DirtyAH6 oss-security disclosure: https://seclists.org/oss-sec/2026/q3/822 Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7bad4bda74dc4713f398d3b7624ff05478e3a568 The published PoC demonstrates local user-to-root privilege escalation. Possible mitigation on systems that do not require IPv6: grubby --update-kernel=ALL --args="ipv6.disable=1" A reboot is required for this mitigation to take effect. Please review the affected RHEL kernels and ensure the upstream fix is backported where necessary.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:71016 https://access.redhat.com/errata/RHSA-2026:71016
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:71213 https://access.redhat.com/errata/RHSA-2026:71213
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:71233 https://access.redhat.com/errata/RHSA-2026:71233
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:71232 https://access.redhat.com/errata/RHSA-2026:71232
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:71565 https://access.redhat.com/errata/RHSA-2026:71565
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:71592 https://access.redhat.com/errata/RHSA-2026:71592
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:71594 https://access.redhat.com/errata/RHSA-2026:71594
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:71606 https://access.redhat.com/errata/RHSA-2026:71606
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:71569 https://access.redhat.com/errata/RHSA-2026:71569
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:71601 https://access.redhat.com/errata/RHSA-2026:71601
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:71599 https://access.redhat.com/errata/RHSA-2026:71599
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Via RHSA-2026:71649 https://access.redhat.com/errata/RHSA-2026:71649
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:71657 https://access.redhat.com/errata/RHSA-2026:71657
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:71631 https://access.redhat.com/errata/RHSA-2026:71631
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:71687 https://access.redhat.com/errata/RHSA-2026:71687
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:74974 https://access.redhat.com/errata/RHSA-2026:74974
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.22 Via RHSA-2026:74428 https://access.redhat.com/errata/RHSA-2026:74428
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.21 Via RHSA-2026:74379 https://access.redhat.com/errata/RHSA-2026:74379
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.20 Via RHSA-2026:74377 https://access.redhat.com/errata/RHSA-2026:74377
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.19 Via RHSA-2026:74433 https://access.redhat.com/errata/RHSA-2026:74433
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.21 Via RHSA-2026:79153 https://access.redhat.com/errata/RHSA-2026:79153
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.18 Via RHSA-2026:79035 https://access.redhat.com/errata/RHSA-2026:79035
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.12 Via RHSA-2026:77315 https://access.redhat.com/errata/RHSA-2026:77315
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.13 Via RHSA-2026:77320 https://access.redhat.com/errata/RHSA-2026:77320
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2026:77548 https://access.redhat.com/errata/RHSA-2026:77548
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2026:77612 https://access.redhat.com/errata/RHSA-2026:77612