CVE-2026-80844
Qualys 위협 인텔 · 심각도 5/5 · QID 765983 · SUSE
공개 익스플로잇
쉬운 악용
대량 데이터 유출
서비스 거부
권한상승
원격코드실행
In the Linux kernel, the following vulnerability has been resolved:
xfrm: ah6: validate routing header segments_left
AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.
That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.
Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.
xfrm: ah6: validate routing header segments_left
AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.
That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.
Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.
타임라인
- NVD 공개
- 첫 보도 The Hacker News · CISA, 실제 공격에 악용된 리눅스 커널 취약점 3건 경고
- 최근 보도 (총 2건) The Hacker News · ⚡ 주간 요약: 시스코 제로데이, AI 에이전트 RCE, ClickFix 공…
날짜 정보 없는 신호: 공개 PoC 3건
공개 익스플로잇 / PoC
- GitHub 공개 PoC 3건 — 대표 레포 ↗