CVE-2026-89783 - Vulnerability Details

- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

The depth check in xfrm6_input_addr() is off by one:

if (1 + sp->len == XFRM_MAX_DEPTH)
goto drop;
...
sp->xvec[sp->len++] = x;

xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode
receive path re-enters IPv6 input via xfrm_trans_reinject() with that
secpath preserved. If the inner packet carries a destination-options HAO
option or a type-2 routing header, xfrm6_input_addr() is called with
sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so
sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write
stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS
flags it and panics under panic_on_warn.

Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also
restores one chain level the old check rejected at sp->len == 5.

UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10
index 6 is out of range for type 'xfrm_state *[6]'

Published: 2026-09-16

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an off‑by‑one depth check in the IPv6 IPsec processing path, which allows an array to be written past its bounds. The write occurs when a full security path is re‑entered with a packet that includes destination options or a type‑2 routing header, causing the kernel to pause and panic. This can lead to a kernel crash and, potentially, arbitrary code execution if the corrupted data can be leveraged.

Affected Systems

All Linux kernel releases that contain the vulnerable xfrm6_input_addr implementation before the fix commit are affected. The patch is present in recent kernel versions that include commit hash 0f679e0523ddfff3fb554336ceb874b0e51e9cd3. Administrators should review their kernel version labels to ensure they are on the post‑fix revision.

Risk and Exploitability

The CVSS score is not provided and EPSS is unavailable, but the flaw can be triggered by an externally supplied IPv6 packet with specific extension headers, so a remote network attacker can exploit it. The vulnerability is not listed in CISA KEV, yet the possibility of a kernel panic leads to denial of service, and the out‑of‑bounds write could in theory facilitate privilege escalation or arbitrary code execution. Immediate patching is recommended.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 91fc387f63c00ddfb5221127a17bac97549a8343
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 68e8737fe8e72f085c608cff322b3d2de8340af1
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< bdcda866c89f9a8b1acdabf02d26cde9fbe501d8
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 48996649222e95008cdb98cd58579e3fc8e5ee06
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 0f679e0523ddfff3fb554336ceb874b0e51e9cd3
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 5f35a29a5eed3d80befd32050843ac88dea3d61a
`9473e1f631de339c50bde1e3bd09e1045fe90fd5`	affected	< 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc

Linux

affected

Version	Status	Constraints
`2.6.25`	affected	—
`0`	unaffected	< 2.6.25
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,91fc387f63c00ddfb5221127a17bac97549a8343)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,68e8737fe8e72f085c608cff322b3d2de8340af1)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,bdcda866c89f9a8b1acdabf02d26cde9fbe501d8)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,48996649222e95008cdb98cd58579e3fc8e5ee06)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,0f679e0523ddfff3fb554336ceb874b0e51e9cd3)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,5f35a29a5eed3d80befd32050843ac88dea3d61a)`	affected	code_commit	—
`[9473e1f631de339c50bde1e3bd09e1045fe90fd5,5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.25`	affected	semver	—
`[0,2.6.25)`	unaffected	generic	—
`[0,5.11.0)`	unaffected	semver	—
`[0,5.16.0)`	unaffected	semver	—
`[0,6.2.0)`	unaffected	semver	—
`[0,6.7.0)`	unaffected	semver	—
`[0,6.13.0)`	unaffected	semver	—
`[0,6.19.0)`	unaffected	semver	—
`[0,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel version that includes the commit correcting the off‑by‑one depth check (see commit 0f679e0523ddfff3fb554336ceb874b0e51e9cd3).
Until a kernel update is available, block or filter IPv6 packets that carry destination options HAO or type‑2 routing headers using firewall rules to prevent the vulnerable code path from executing.
Monitor system logs for UBSAN "array-index-out-of-bounds" messages or kernel panic traces to detect any successful exploitation attempts.

Generated by OpenCVE AI on September 16, 2026 at 14:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f679e0523ddfff3fb554336ceb874b0e51e9cd3
https://git.kernel.org/stable/c/48996649222e95008cdb98cd58579e3fc8e5ee06
https://git.kernel.org/stable/c/5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc
https://git.kernel.org/stable/c/5f35a29a5eed3d80befd32050843ac88dea3d61a
https://git.kernel.org/stable/c/68e8737fe8e72f085c608cff322b3d2de8340af1
https://git.kernel.org/stable/c/8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77
https://git.kernel.org/stable/c/91fc387f63c00ddfb5221127a17bac97549a8343
https://git.kernel.org/stable/c/bdcda866c89f9a8b1acdabf02d26cde9fbe501d8

History

Wed, 16 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 16 Sep 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check in xfrm6_input_addr() is off by one: if (1 + sp->len == XFRM_MAX_DEPTH) goto drop; ... sp->xvec[sp->len++] = x; xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode receive path re-enters IPv6 input via xfrm_trans_reinject() with that secpath preserved. If the inner packet carries a destination-options HAO option or a type-2 routing header, xfrm6_input_addr() is called with sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS flags it and panics under panic_on_warn. Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also restores one chain level the old check rejected at sp->len == 5. UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10 index 6 is out of range for type 'xfrm_state *[6]'
Title		xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f679e0523ddfff3fb554336ceb874b0e51e9cd3 https://git.kernel.org/stable/c/48996649222e95008cdb98cd58579e3fc8e5ee06 https://git.kernel.org/stable/c/5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc https://git.kernel.org/stable/c/5f35a29a5eed3d80befd32050843ac88dea3d61a https://git.kernel.org/stable/c/68e8737fe8e72f085c608cff322b3d2de8340af1 https://git.kernel.org/stable/c/8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77 https://git.kernel.org/stable/c/91fc387f63c00ddfb5221127a17bac97549a8343 https://git.kernel.org/stable/c/bdcda866c89f9a8b1acdabf02d26cde9fbe501d8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-16T08:48:21.761Z

Updated: 2026-09-16T14:38:34.989Z

Reserved: 2026-09-11T19:38:34.765Z

Link: CVE-2026-89783

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-16T09:17:08.930

Modified: 2026-09-16T15:18:08.720

Link: CVE-2026-89783

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-16T15:15:14Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object