CVE-2026-89783

CVE-2026-89783 is an off-by-one bounds-check flaw in the Linux kernel's IPv6 IPsec input path: xfrm6_input_addr() tests '1 + sp->len == XFRM_MAX_DEPTH' instead of 'sp->len >= XFRM_MAX_DEPTH', so a secpath already holding the maximum of 6 transform states passes the check and 'sp->xvec[sp->len++]' writes one pointer past the 6-element xvec[] array. It is reached when a packet traverses a full 6-level XFRM chain and, in transport mode, is re-injected into IPv6 input via xfrm_trans_reinject(); if the inner packet carries a Home Address Option (destination options) or a type-2 routing header, xfrm6_input_addr() runs again with sp->len == 6 and writes one slot out of bounds. The stray write stays within the same sec_path allocation, so KASAN does not see it, but UBSAN_BOUNDS flags it ('index 6 is out of range for type xfrm_state *[6]' at net/ipv6/xfrm6_input.c:309) and the kernel panics under panic_on_warn; the assigned CVSS 3.1 score is 9.8 (critical) with high confidentiality, integrity and availability impact. Affected are Linux systems running IPv6 with kernel XFRM/IPsec in transport mode, typically VPN gateways and IPsec peers with nested transform chains; hosts without IPv6 IPsec transport mode are not reachable. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists at this time.

What to do: Update kernels when the fix (replacing the depth check with 'sp->len >= XFRM_MAX_DEPTH', matching xfrm_input()) reaches your distribution or LTS branch. Interim mitigations: keep IPv6 transport-mode XFRM chains below the 6-state maximum where possible and filter inbound IPv6 destination-options Home Address Option and type-2 Routing headers at the perimeter. Audit hosts with 'ip xfrm state'/'ip xfrm policy' to confirm whether IPv6 transport-mode IPsec is in use, and prioritize internet-facing VPN gateways.