CVE-2026-80976
An unprivileged local user can exploit a flaw in the Linux kernel's seg6 subsystem to cause an out-of-bounds memory read. By injecting a crafted IPv6 packet with specific extension headers, the kernel retains stale offset information from the outer packet after decapsulation, leading to reading beyond the packet buffer. This could potentially lead to information disclosure or denial of service.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernels with the seg6 subsystem enabled and configured to allow unprivileged users to install local SIDs (e.g., via network namespaces). Specific affected versions are not listed in the provided data, but any kernel containing the vulnerable code path is at risk.
Real-world impact
This vulnerability requires local access and specific kernel configuration (seg6 with End.DT6 routes). While not remotely exploitable, it could be used by an unprivileged user to crash the kernel or leak memory, potentially leading to privilege escalation or denial of service.
Why this severity
A CVSS score of 9.8 (critical) reflects the combination of no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. However, exploitation requires local access and specific kernel features, which tempers the practical risk for most deployments.
What to do about it
- 011. Upgrade the Linux kernel to a version that includes the patch described in the NVD advisory, which resets the IPv6 control block after decapsulation and properly restores the incoming interface index and L3 slave state.
- 022. Reboot the system to boot into the patched kernel.
NVD description includes the fix details.
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 4h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.