Executive brief
The Linux kernel's IPv6 IPsec stack contains an array bounds check error in the xfrm6_input_addr() function that can be triggered by specially crafted IPv6 packets with destination options or routing headers. An attacker on the network can send malformed packets to cause a kernel panic or potentially achieve code execution on systems running affected versions.
Technical details
The vulnerability is an off-by-one error in a depth boundary check in net/ipv6/xfrm6_input.c. The original check `if (1 + sp->len == XFRM_MAX_DEPTH)` incorrectly allows writing to xvec[sp->len] when sp->len equals XFRM_MAX_DEPTH (6), causing an out-of-bounds array write. The flaw is triggered when the transport-mode receive path re-enters IPv6 input processing via xfrm_trans_reinject() with a full secpath (sp->len == 6), and the inner packet contains destination-options HAO headers or type-2 routing headers. While the out-of-bounds write stays within the sec_path structure allocation (not detected by KASAN), UBSAN_BOUNDS detects and flags the violation, causing kernel panic under panic_on_warn configurations. The fix changes the check to `if (sp->len >= XFRM_MAX_DEPTH)` to properly reject packets when the chain is full.
Affected products
- Linux Linux kernel multiple versions (2.6.11 through 7.2 and later)
Timeline
- 2026-09-16: disclosed: CVE-2026-89783 published
- 2026-07-04: patched: Fix committed upstream (commit 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc)