CVE-2026-80840 - Vulnerability Details

- ipv6: seg6: clear IPv4 control block on IPIP decapsulation

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: seg6: clear IPv4 control block on IPIP decapsulation

End.DX4 and End.DT4 decapsulate an IPv4 packet through
decap_and_validate() and send it directly to IPv4 routing. The inner
packet therefore bypasses ip_rcv_core(), which normally clears IPCB
before IPv4 interprets skb->cb.

The skb instead retains IP6CB data from the outer packet. IP6CB and
IPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps
IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and
ts.

The sender can make the stale optlen byte nonzero with a valid outer
extension-header chain. The reproducers put an eight-byte Destination
Options header immediately after the 40-byte IPv6 header and before the
Segment Routing Header. ipv6_destopt_rcv() records the sender-controlled
Destination Options offset in both lastopt and nhoff, setting them to
40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees
optlen = 40 and rr = 40.

Both tcp_v4_save_options() and __ip_options_echo() skip option copying
when optlen is zero. Here optlen is 40, so the TCP SYN path allocates
room for 40 bytes of option data and calls __ip_options_echo(). The
stale rr value makes that function read inner packet byte 41 as the
Record Route option length. The reproducers set that sender-controlled
byte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte
option-data area.

Separate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5
kernel both produced:

BUG: KASAN: slab-out-of-bounds in __ip_options_echo()
Write of size 255

The relevant End.DX4 call path is:

__ip_options_echo
tcp_v4_route_req
tcp_conn_request
tcp_v4_conn_request
tcp_rcv_state_process
tcp_v4_do_rcv
tcp_v4_rcv
ip_protocol_deliver_rcu
ip_local_deliver_finish
ip_local_deliver
input_action_end_dx4_finish
input_action_end_dx4

The relevant End.DT4 call path is:

__ip_options_echo
tcp_v4_route_req
tcp_conn_request
tcp_v4_conn_request
tcp_rcv_state_process
tcp_v4_do_rcv
tcp_v4_rcv
ip_protocol_deliver_rcu
ip_local_deliver_finish
ip_local_deliver
input_action_end_dt4

tcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so
it does not appear as a separate frame.

When decap_and_validate() handles IPPROTO_IPIP, save the ingress
interface from IP6CB, clear IPCB, and restore the saved value. Doing
this in the common decapsulation path covers End.DX4, End.DT4, and
End.DT46's IPv4 arm.

Use IP6CB(skb)->iif rather than skb->skb_iif. These actions run after
l3mdev processing, which can replace skb_iif with the L3 master;
IP6CB iif still records the receiving interface set at IPv6 ingress.

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel mistakenly reuses the IPv4 control block after decapsulating an IPv6 packet that carries an IPIP payload. Because the IPv6 control block and IPv4 control block share the same skb->cb storage, a sender can embed a non‑zero options length in the outer IPv6 packet that is carried over into the inner IPv4 packet. When the kernel processes the inner packet it allocates space for a 40‑byte IPv4 option buffer but, due to the stale length, copies 255 bytes into that buffer, triggering an out‑of‑bounds write and a stack overflow that can lead to kernel panic or arbitrary code execution.

Affected Systems

All Linux kernel builds running the unpatched commit 0e3f01fe2e704e76af4385b8a1742641885a191c or earlier. The vulnerability exists until the commit that clears IPCB during IPIP decapsulation is applied, so any kernel that has not received this patch is vulnerable.

Risk and Exploitability

No CVSS score or EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The exploit path requires the ability to send specially crafted IPv6 packets with an IPIP payload and a Destination Options header containing a non‑zero options length. If an attacker can deliver such traffic to the target, the risk of kernel compromise is high, but the exact likelihood of exploitation in the wild remains uncertain.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< 10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< eb0f422487228e140f3d609b032ac61aedcab8fa
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< 9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< f52f1e75716d2ee49e013edf204ac92337c72fd8
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< 0e3f01fe2e704e76af4385b8a1742641885a191c
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< 3e4476e58343fb8f2fffced9e22d935376b17aaf
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< bf1c1151560d11036a144d917fa4c131831342d7
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< f4be3b391265e24c7720fc867c50062b436acf33
`891ef8dd2a8d14e4e73a81dcdb135b574c57f556`	affected	< 44930446dde45a7a90fe1446fa38eb0e2c561646

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.269`	unaffected	≤ 5.10.*
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.49`	unaffected	≤ 6.18.*
`7.1.13`	unaffected	≤ 7.1.*
`7.2.3`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the commit that clears IPCB on IPIP decapsulation.
If a kernel update is not immediately available, block or restrict IPIP traffic (protocol 41) on IPv6 interfaces using firewall rules.
Apply network segmentation or transport segmentation to ensure that only trusted hosts or networks can send IPIP traffic to the susceptible systems.

Generated by OpenCVE AI on September 4, 2026 at 19:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c
https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667
https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf
https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646
https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c
https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7
https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa
https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33
https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8

History

Fri, 04 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787

Fri, 04 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decap_and_validate() and send it directly to IPv4 routing. The inner packet therefore bypasses ip_rcv_core(), which normally clears IPCB before IPv4 interprets skb->cb. The skb instead retains IP6CB data from the outer packet. IP6CB and IPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and ts. The sender can make the stale optlen byte nonzero with a valid outer extension-header chain. The reproducers put an eight-byte Destination Options header immediately after the 40-byte IPv6 header and before the Segment Routing Header. ipv6_destopt_rcv() records the sender-controlled Destination Options offset in both lastopt and nhoff, setting them to 40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees optlen = 40 and rr = 40. Both tcp_v4_save_options() and __ip_options_echo() skip option copying when optlen is zero. Here optlen is 40, so the TCP SYN path allocates room for 40 bytes of option data and calls __ip_options_echo(). The stale rr value makes that function read inner packet byte 41 as the Record Route option length. The reproducers set that sender-controlled byte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte option-data area. Separate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5 kernel both produced: BUG: KASAN: slab-out-of-bounds in __ip_options_echo() Write of size 255 The relevant End.DX4 call path is: __ip_options_echo tcp_v4_route_req tcp_conn_request tcp_v4_conn_request tcp_rcv_state_process tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish ip_local_deliver input_action_end_dx4_finish input_action_end_dx4 The relevant End.DT4 call path is: __ip_options_echo tcp_v4_route_req tcp_conn_request tcp_v4_conn_request tcp_rcv_state_process tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish ip_local_deliver input_action_end_dt4 tcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so it does not appear as a separate frame. When decap_and_validate() handles IPPROTO_IPIP, save the ingress interface from IP6CB, clear IPCB, and restore the saved value. Doing this in the common decapsulation path covers End.DX4, End.DT4, and End.DT46's IPv4 arm. Use IP6CB(skb)->iif rather than skb->skb_iif. These actions run after l3mdev processing, which can replace skb_iif with the L3 master; IP6CB iif still records the receiving interface set at IPv6 ingress.
Title		ipv6: seg6: clear IPv4 control block on IPIP decapsulation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667 https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646 https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7 https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33 https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:54:50.403Z

Updated: 2026-09-04T15:54:50.403Z

Reserved: 2026-08-26T14:34:25.796Z

Link: CVE-2026-80840

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:12.440

Modified: 2026-09-04T16:18:12.440

Link: CVE-2026-80840

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T19:30:04Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object