Executive brief
The Linux kernel's IPv6 Authentication Header (AH6) processing contains a buffer overflow vulnerability when handling IPv6 routing headers with mismatched segment counts. An attacker can craft a malicious raw IPv6 packet that causes the kernel to read and write 4,000+ bytes outside allocated memory boundaries, potentially leading to denial of service or privilege escalation on affected systems.
Technical details
The vulnerability exists in the ipv6_rearrange_rthdr() function within net/ipv6/ah6.c. The function failed to validate that the segments_left field in a routing header does not exceed the number of addresses (hdrlen field). For raw IPv6 HDRINCL packets, segments_left can be set to 255 while hdrlen describes only one address, causing address pointer arithmetic to move 4,064 bytes backward and pass an out-of-bounds length to memmove(). The attack requires local network access or ability to inject raw IPv6 packets. A patch adds validation of the segments_left invariant before address rearrangement, returning -EINVAL for malformed headers and propagating the error through existing AH6 input/output paths.
Affected products
- Linux Linux kernel 2.6.12 and later (before fix)
Timeline
- 2026-09-04: disclosed
- 2026-09-02: patched: Fix committed upstream before disclosure date