CVE-2026-80976

Estado: RecibidaCrítica (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

seg6: reset IP6CB after IPv6 decapsulation

decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet, including nhoff and extension-header flags.

End.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6 input path. An unprivileged user can reach End.DT6 from a user and net namespace by installing a local SID and injecting an outer packet with Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet.

Leer descripción completaMostrar menos

The outer extension headers leave a large nhoff in IP6CB. After decapsulation, ip6_protocol_deliver_rcu() uses that stale offset on the inner packet and reads beyond the skb head. KASAN reports:

Before clearing IP6CB for an inner IPv6 packet, save its incoming interface index and L3 slave state. Restore both after the clear and set nhoff to the inner IPv6 base-header nexthdr field.

Use IP6CB(skb)->iif rather than skb->skb_iif because VRF processing can replace skb_iif with the L3 master while IP6CB keeps the receiving interface. Preserve IP6SKB_L3SLAVE for the same reason.

Detalles técnicos trazas, registros y código del informe original

  BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu
  ip6_protocol_deliver_rcu+0x1118/0x1450
  ip6_input_finish+0x11b/0x240
  seg6_local_input_core+0xed/0x2e0
  lwtunnel_input+0x1e9/0x4e0
  ipv6_rthdr_rcv+0x525f/0x6c50
  ip6_protocol_deliver_rcu+0xcb7/0x1450

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.71%
Percentil entre todas las CVEs puntuadas: 52
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1498.002 Reflection Amplificationimpact75 %
Impacto secundarioT1005 Data from Local Systemcollection70 %

Vulnerabilidad de kernel accesible remotamente (AV:N, PR:N, UI:N) que permite lectura fuera de límites en IPv6 via paquetes SRv6 manipulados, causando DoS y potencial lectura de memoria del kernel.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-80976",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "d1f0d353358987ca87f21d8956e2d2854951130d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "a0e2b0a3718f0cf9fb0ee41710b4a6348a7315c8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "9ae92198c24d7dacd4070e2f34f6e1ed3a63061c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "96c74420ac92930a7e0f21770818544eee4a93d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "2b154e96fcb3f01fd42765c64e0a56820fbc16eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "cfa186a0857a0f831dfca67b16bbc40ecfdf3280",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "c73fb911e02b9a766c950bc9707f3e3a96ffd702",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d7a669dd2f8ba07a17423f4ad586dfc0379882f7",
              "lessThan": "f967455fb2a5a2079b9eb5823e9ccf359174bf9f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/ipv6/seg6_local.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv6/seg6_local.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:03.887",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2b154e96fcb3f01fd42765c64e0a56820fbc16eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/96c74420ac92930a7e0f21770818544eee4a93d7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ae92198c24d7dacd4070e2f34f6e1ed3a63061c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a0e2b0a3718f0cf9fb0ee41710b4a6348a7315c8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c73fb911e02b9a766c950bc9707f3e3a96ffd702",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cfa186a0857a0f831dfca67b16bbc40ecfdf3280",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d1f0d353358987ca87f21d8956e2d2854951130d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f967455fb2a5a2079b9eb5823e9ccf359174bf9f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: reset IP6CB after IPv6 decapsulation\n\ndecap_and_validate() pulls the outer SRv6 headers and makes the inner\npacket the skb network header. The IPv6 control block still contains\nvalues collected while parsing the outer packet, including nhoff and\nextension-header flags.\n\nEnd.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6\ninput path. An unprivileged user can reach End.DT6 from a user and net\nnamespace by installing a local SID and injecting an outer packet with\nHop-by-Hop and Destination Options headers followed by an SRH and a\nminimal inner IPv6 packet.\n\nThe outer extension headers leave a large nhoff in IP6CB. After\ndecapsulation, ip6_protocol_deliver_rcu() uses that stale offset on the\ninner packet and reads beyond the skb head. KASAN reports:\n\n  BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu\n  ip6_protocol_deliver_rcu+0x1118/0x1450\n  ip6_input_finish+0x11b/0x240\n  seg6_local_input_core+0xed/0x2e0\n  lwtunnel_input+0x1e9/0x4e0\n  ipv6_rthdr_rcv+0x525f/0x6c50\n  ip6_protocol_deliver_rcu+0xcb7/0x1450\n\nBefore clearing IP6CB for an inner IPv6 packet, save its incoming\ninterface index and L3 slave state. Restore both after the clear and set\nnhoff to the inner IPv6 base-header nexthdr field.\n\nUse IP6CB(skb)->iif rather than skb->skb_iif because VRF processing can\nreplace skb_iif with the L3 master while IP6CB keeps the receiving\ninterface. Preserve IP6SKB_L3SLAVE for the same reason."
    }
  ],
  "lastModified": "2026-09-14T13:18:52.327",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}