CVE-2026-80844

Published Sep 4, 2026

Last updated 16 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-80844, also known as "DirtyAH6," is a vulnerability found in the Linux kernel's implementation of the IPv6 Authentication Header (AH) within its XFRM/IPsec subsystem. The flaw stems from the `ipv6_rearrange_rthdr()` function, which incorrectly assumes that the `segments_left` field in a routing header is not larger than the number of addresses described by the header's length field. This assumption fails for raw IPv6 HDRINCL packets, where a packet with a `hdrlen` of 2 can carry an arbitrary `segments_left` value. When `segments_left` is set to 255, the function attempts to move its address pointer 4,064 bytes backward and then passes a 4,064-byte length to `memmove()`, leading to an out-of-bounds memory access. This memory corruption can be exploited for local privilege escalation, particularly when unprivileged user namespaces are enabled. Additionally, under specific conditions where a system acts as an IPv6 router or gateway utilizing AH in transport mode, the same underlying bug can be triggered remotely, potentially causing a denial-of-service.

Description: In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Received

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 13

References

Sources include official advisories and independent security research.

Overview

AI description

Social media

References