SB20260912403 - Out-of-bounds read in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-80976)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to stale IPv6 control block state in the decap_and_validate() function of the seg6 local processing component when processing a decapsulated IPv6 packet through an End.DX6 or End.DT6 route. A local user can install a local SID and inject a crafted outer IPv6 packet to cause an out-of-bounds read.

The outer packet contains Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2b154e96fcb3f01fd42765c64e0a56820fbc16eb
• https://git.kernel.org/stable/c/c73fb911e02b9a766c950bc9707f3e3a96ffd702
• https://git.kernel.org/stable/c/cfa186a0857a0f831dfca67b16bbc40ecfdf3280
• https://git.kernel.org/stable/c/f967455fb2a5a2079b9eb5823e9ccf359174bf9f