{"id":"CVE-2026-80976","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-80976","generatedAt":"2026-10-28T04:03:37.043Z","title":"In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header.","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: reset IP6CB after IPv6 decapsulation\n\ndecap_and_validate() pulls the outer SRv6 headers and makes the inner\npacket the skb network header. The IPv6 control block still contains\nvalues collected while parsing the outer packet, including nhoff and\nextension-header flags.\n\nEnd.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6\ninput path. An unprivileged user can reach End.DT6 from a user and net\nnamespace by installing a local SID and injecting an outer packet with\nHop-by-Hop and Destination Options headers followed by an SRH and a\nminimal inner IPv6 packet.\n\nThe outer extension headers leave a large nhoff in IP6CB. After\ndecapsulation, ip6_protocol_deliver_rcu() uses that stale offset on the\ninner packet and reads beyond the skb head. KASAN reports:\n\n  BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu\n  ip6_protocol_deliver_rcu+0x1118/0x1450\n  ip6_input_finish+0x11b/0x240\n  seg6_local_input_core+0xed/0x2e0\n  lwtunnel_input+0x1e9/0x4e0\n  ipv6_rthdr_rcv+0x525f/0x6c50\n  ip6_protocol_deliver_rcu+0xcb7/0x1450\n\nBefore clearing IP6CB for an inner IPv6 packet, save its incoming\ninterface index and L3 slave state. Restore both after the clear and set\nnhoff to the inner IPv6 base-header nexthdr field.\n\nUse IP6CB(skb)->iif rather than skb->skb_iif because VRF processing can\nreplace skb_iif with the L3 master while IP6CB keeps the receiving\ninterface. Preserve IP6SKB_L3SLAVE for the same reason.","published":"2026-09-11T20:19:04.000Z","lastModified":"2026-10-19T09:17:30.000Z","status":"Received","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":[],"affected":[],"epss":{"score":0.00714,"percentile":0.53478,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/2b154e96fcb3f01fd42765c64e0a56820fbc16eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96c74420ac92930a7e0f21770818544eee4a93d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9ae92198c24d7dacd4070e2f34f6e1ed3a63061c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0e2b0a3718f0cf9fb0ee41710b4a6348a7315c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c73fb911e02b9a766c950bc9707f3e3a96ffd702","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfa186a0857a0f831dfca67b16bbc40ecfdf3280","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1f0d353358987ca87f21d8956e2d2854951130d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f967455fb2a5a2079b9eb5823e9ccf359174bf9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80976","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}