CVE-2026-80840 (GCVE-0-2026-80840)
Vulnerability from cvelistv5 – Published: 2026-09-04 15:54 – Updated: 2026-10-19 08:44
VLAI
EPSS
VEX
Title
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
End.DX4 and End.DT4 decapsulate an IPv4 packet through
decap_and_validate() and send it directly to IPv4 routing. The inner
packet therefore bypasses ip_rcv_core(), which normally clears IPCB
before IPv4 interprets skb->cb.
The skb instead retains IP6CB data from the outer packet. IP6CB and
IPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps
IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and
ts.
The sender can make the stale optlen byte nonzero with a valid outer
extension-header chain. The reproducers put an eight-byte Destination
Options header immediately after the 40-byte IPv6 header and before the
Segment Routing Header. ipv6_destopt_rcv() records the sender-controlled
Destination Options offset in both lastopt and nhoff, setting them to
40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees
optlen = 40 and rr = 40.
Both tcp_v4_save_options() and __ip_options_echo() skip option copying
when optlen is zero. Here optlen is 40, so the TCP SYN path allocates
room for 40 bytes of option data and calls __ip_options_echo(). The
stale rr value makes that function read inner packet byte 41 as the
Record Route option length. The reproducers set that sender-controlled
byte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte
option-data area.
Separate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5
kernel both produced:
BUG: KASAN: slab-out-of-bounds in __ip_options_echo()
Write of size 255
The relevant End.DX4 call path is:
__ip_options_echo
tcp_v4_route_req
tcp_conn_request
tcp_v4_conn_request
tcp_rcv_state_process
tcp_v4_do_rcv
tcp_v4_rcv
ip_protocol_deliver_rcu
ip_local_deliver_finish
ip_local_deliver
input_action_end_dx4_finish
input_action_end_dx4
The relevant End.DT4 call path is:
__ip_options_echo
tcp_v4_route_req
tcp_conn_request
tcp_v4_conn_request
tcp_rcv_state_process
tcp_v4_do_rcv
tcp_v4_rcv
ip_protocol_deliver_rcu
ip_local_deliver_finish
ip_local_deliver
input_action_end_dt4
tcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so
it does not appear as a separate frame.
When decap_and_validate() handles IPPROTO_IPIP, save the ingress
interface from IP6CB, clear IPCB, and restore the saved value. Doing
this in the common decapsulation path covers End.DX4, End.DT4, and
End.DT46's IPv4 arm.
Use IP6CB(skb)->iif rather than skb->skb_iif. These actions run after
l3mdev processing, which can replace skb_iif with the L3 master;
IP6CB iif still records the receiving interface set at IPv6 ingress.
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < 10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667
(git)
Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < eb0f422487228e140f3d609b032ac61aedcab8fa (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < 9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < f52f1e75716d2ee49e013edf204ac92337c72fd8 (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < 0e3f01fe2e704e76af4385b8a1742641885a191c (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < 3e4476e58343fb8f2fffced9e22d935376b17aaf (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < bf1c1151560d11036a144d917fa4c131831342d7 (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < f4be3b391265e24c7720fc867c50062b436acf33 (git) Affected: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 , < 44930446dde45a7a90fe1446fa38eb0e2c561646 (git) |
guessed | |
| Linux | Linux |
Affected:
4.14
Unaffected: 0 , < 4.14 (semver) Unaffected: 5.10.269 , ≤ 5.10.* (semver) Unaffected: 5.15.220 , ≤ 5.15.* (semver) Unaffected: 6.1.187 , ≤ 6.1.* (semver) Unaffected: 6.6.156 , ≤ 6.6.* (semver) Unaffected: 6.12.108 , ≤ 6.12.* (semver) Unaffected: 6.18.49 , ≤ 6.18.* (semver) Unaffected: 7.1.13 , ≤ 7.1.* (semver) Unaffected: 7.2.3 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_local.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "eb0f422487228e140f3d609b032ac61aedcab8fa",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "f52f1e75716d2ee49e013edf204ac92337c72fd8",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "0e3f01fe2e704e76af4385b8a1742641885a191c",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "3e4476e58343fb8f2fffced9e22d935376b17aaf",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "bf1c1151560d11036a144d917fa4c131831342d7",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "f4be3b391265e24c7720fc867c50062b436acf33",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "44930446dde45a7a90fe1446fa38eb0e2c561646",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_local.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.13",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.3",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: seg6: clear IPv4 control block on IPIP decapsulation\n\nEnd.DX4 and End.DT4 decapsulate an IPv4 packet through\ndecap_and_validate() and send it directly to IPv4 routing. The inner\npacket therefore bypasses ip_rcv_core(), which normally clears IPCB\nbefore IPv4 interprets skb-\u003ecb.\n\nThe skb instead retains IP6CB data from the outer packet. IP6CB and\nIPCB use the same skb-\u003ecb storage, so IP6CB(skb)-\u003elastopt overlaps\nIPCB(skb)-\u003eopt.optlen and srr, while IP6CB(skb)-\u003enhoff overlaps rr and\nts.\n\nThe sender can make the stale optlen byte nonzero with a valid outer\nextension-header chain. The reproducers put an eight-byte Destination\nOptions header immediately after the 40-byte IPv6 header and before the\nSegment Routing Header. ipv6_destopt_rcv() records the sender-controlled\nDestination Options offset in both lastopt and nhoff, setting them to\n40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees\noptlen = 40 and rr = 40.\n\nBoth tcp_v4_save_options() and __ip_options_echo() skip option copying\nwhen optlen is zero. Here optlen is 40, so the TCP SYN path allocates\nroom for 40 bytes of option data and calls __ip_options_echo(). The\nstale rr value makes that function read inner packet byte 41 as the\nRecord Route option length. The reproducers set that sender-controlled\nbyte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte\noption-data area.\n\nSeparate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5\nkernel both produced:\n\n BUG: KASAN: slab-out-of-bounds in __ip_options_echo()\n Write of size 255\n\nThe relevant End.DX4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dx4_finish\n input_action_end_dx4\n\nThe relevant End.DT4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dt4\n\ntcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so\nit does not appear as a separate frame.\n\nWhen decap_and_validate() handles IPPROTO_IPIP, save the ingress\ninterface from IP6CB, clear IPCB, and restore the saved value. Doing\nthis in the common decapsulation path covers End.DX4, End.DT4, and\nEnd.DT46\u0027s IPv4 arm.\n\nUse IP6CB(skb)-\u003eiif rather than skb-\u003eskb_iif. These actions run after\nl3mdev processing, which can replace skb_iif with the L3 master;\nIP6CB iif still records the receiving interface set at IPv6 ingress."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:44:33.475Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667"
},
{
"url": "https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa"
},
{
"url": "https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c"
},
{
"url": "https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8"
},
{
"url": "https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c"
},
{
"url": "https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf"
},
{
"url": "https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7"
},
{
"url": "https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33"
},
{
"url": "https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646"
}
],
"title": "ipv6: seg6: clear IPv4 control block on IPIP decapsulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80840",
"datePublished": "2026-09-04T15:54:50.403Z",
"dateReserved": "2026-08-26T14:34:25.796Z",
"dateUpdated": "2026-10-19T08:44:33.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80840",
"date": "2026-11-01",
"epss": "0.00205",
"percentile": "0.10472"
},
"microsoft_vex": {
"current_release_date": "2026-09-24T01:06:04.000Z",
"cve": "CVE-2026-80840",
"id": "msrc_CVE-2026-80840",
"initial_release_date": "2026-09-06T04:36:50.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "ipv6: seg6: clear IPv4 control block on IPIP decapsulation",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80840.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_local.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "eb0f422487228e140f3d609b032ac61aedcab8fa",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "f52f1e75716d2ee49e013edf204ac92337c72fd8",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "0e3f01fe2e704e76af4385b8a1742641885a191c",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "3e4476e58343fb8f2fffced9e22d935376b17aaf",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "bf1c1151560d11036a144d917fa4c131831342d7",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "f4be3b391265e24c7720fc867c50062b436acf33",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "44930446dde45a7a90fe1446fa38eb0e2c561646",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_local.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: seg6: clear IPv4 control block on IPIP decapsulation\n\nEnd.DX4 and End.DT4 decapsulate an IPv4 packet through\ndecap_and_validate() and send it directly to IPv4 routing. The inner\npacket therefore bypasses ip_rcv_core(), which normally clears IPCB\nbefore IPv4 interprets skb-\u003ecb.\n\nThe skb instead retains IP6CB data from the outer packet. IP6CB and\nIPCB use the same skb-\u003ecb storage, so IP6CB(skb)-\u003elastopt overlaps\nIPCB(skb)-\u003eopt.optlen and srr, while IP6CB(skb)-\u003enhoff overlaps rr and\nts.\n\nThe sender can make the stale optlen byte nonzero with a valid outer\nextension-header chain. The reproducers put an eight-byte Destination\nOptions header immediately after the 40-byte IPv6 header and before the\nSegment Routing Header. ipv6_destopt_rcv() records the sender-controlled\nDestination Options offset in both lastopt and nhoff, setting them to\n40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees\noptlen = 40 and rr = 40.\n\nBoth tcp_v4_save_options() and __ip_options_echo() skip option copying\nwhen optlen is zero. Here optlen is 40, so the TCP SYN path allocates\nroom for 40 bytes of option data and calls __ip_options_echo(). The\nstale rr value makes that function read inner packet byte 41 as the\nRecord Route option length. The reproducers set that sender-controlled\nbyte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte\noption-data area.\n\nSeparate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5\nkernel both produced:\n\n BUG: KASAN: slab-out-of-bounds in __ip_options_echo()\n Write of size 255\n\nThe relevant End.DX4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dx4_finish\n input_action_end_dx4\n\nThe relevant End.DT4 call path is:\n\n __ip_options_echo\n tcp_v4_route_req\n tcp_conn_request\n tcp_v4_conn_request\n tcp_rcv_state_process\n tcp_v4_do_rcv\n tcp_v4_rcv\n ip_protocol_deliver_rcu\n ip_local_deliver_finish\n ip_local_deliver\n input_action_end_dt4\n\ntcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so\nit does not appear as a separate frame.\n\nWhen decap_and_validate() handles IPPROTO_IPIP, save the ingress\ninterface from IP6CB, clear IPCB, and restore the saved value. Doing\nthis in the common decapsulation path covers End.DX4, End.DT4, and\nEnd.DT46\u0027s IPv4 arm.\n\nUse IP6CB(skb)-\u003eiif rather than skb-\u003eskb_iif. These actions run after\nl3mdev processing, which can replace skb_iif with the L3 master;\nIP6CB iif still records the receiving interface set at IPv6 ingress."
}
],
"id": "CVE-2026-80840",
"lastModified": "2026-10-19T09:17:19.333",
"metrics": {},
"published": "2026-09-04T16:18:12.440",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-10-30T03:33:38+00:00",
"cve": "CVE-2026-80840",
"id": "CVE-2026-80840",
"initial_release_date": "2026-09-04T00:00:00+00:00",
"product_status:known_affected": "188",
"product_status:known_not_affected": "91",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: ipv6: seg6: clear IPv4 control block on IPIP decapsulation",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80840.json",
"version": "3"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.