CVE-2026-80976

The Linux kernel's SRv6 implementation fails to reset the IPv6 control block (IP6CB) after decap_and_validate() strips the outer SRv6 headers, so stale nhoff offsets and extension-header flags from the outer packet persist when End.DX6/End.DT6 forward the inner packet into the IPv6 input path. An unprivileged local user with access to a user and network namespace can install a local SID and inject an outer packet containing Hop-by-Hop and Destination Options headers plus an SRH and a minimal inner IPv6 packet; the leftover large nhoff then makes ip6_protocol_deliver_rcu() read beyond the skb head, confirmed by KASAN as a slab-out-of-bounds read. The direct impact is an out-of-bounds read in kernel memory, which plausibly enables denial of service and potential information disclosure, and CVSS 3.1 has been assigned at 9.8 (critical, network vector, no privileges required). Systems affected are Linux kernels with SRv6 (seg6) support enabled where End.DX6/End.DT6 local SIDs can be reached, including multi-tenant hosts where unprivileged users can create user/network namespaces. No public PoC is known and there is no evidence of in-the-wild exploitation; the issue is not on the CISA KEV list.

What to do: Apply a kernel update that contains the seg6 fix (which clears IP6CB for the inner packet, restores the saved interface index and L3 slave state, and sets nhoff to the inner base header's nexthdr). If patching is delayed, restrict unprivileged user/network namespaces (e.g., set user.max_user_namespaces=0 or disable unprivileged userns) and avoid configuring SRv6 End.DX6/End.DT6 local SIDs reachable from untrusted sources. Audit hosts to see whether the seg6 module is loaded and whether any SRv6 local SIDs are configured, and monitor for kernel slab-out-of-bounds reports from ip6_protocol_deliver_rcu.