CVE-2026-80976

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decapandvalidate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

CVE-2026-80976 seg6: reset IP6CB after IPv6 decapsulation

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decapandvalidate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

CVE-2026-80976

CVE-2026-80976 is a slab-out-of-bounds read in the Linux kernel's SRv6 (seg6) processing. After decap_and_validate() strips outer SRv6 headers, the IPv6 control block (IP6CB) retains a stale nhoff value from the outer packet's extension headers. When the inner IPv6 packet is delivered via End.DX6...