In the Linux kernel, the following vulnerability has been resolved:
xfrm: ah6: validate routing header segments_left
AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field.
That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access.
Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.1.186-228.376Upgrade bpftool-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12Upgrade perf6.18-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf6.12Upgrade python3-perfUpgrade bpftool6.18Upgrade kernel6.18-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel6.18-modules-extra-commonUpgrade python3-perf6.18-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.18-debuginfo-common-aarch64Upgrade python3-perf6.18Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.18Upgrade kernel-develUpgrade kernel6.12-tools-develUpgrade perf-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-develUpgrade kernel6.12-modules-extraUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-toolsUpgrade kernel6.18-tools-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-livepatch-6.12.103-129.197Upgrade bpftool6.12Upgrade kernel6.12-tools-debuginfoUpgrade kernel-tools-develUpgrade bpftool6.18-debuginfoUpgrade kernel6.18-modules-extraUpgrade kernel6.18-develUpgrade kernel6.12-debuginfoUpgrade microvm-kernel6.18Upgrade kernel6.18-headersUpgrade kernel-modules-extra-commonUpgrade python3-perf6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade perf6.12Upgrade kernel-livepatch-6.18.48-109.150Upgrade bpftoolUpgrade kernel6.18-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf6.18Upgrade kernel | Sep 30, 2026 | Sep 4, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 21, 2026 | Sep 4, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Oct 7, 2026 | Sep 4, 2026 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Sep 22, 2026 | Sep 4, 2026 |
| Rocky_linux | — | Upgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade python3-perfUpgrade kernel-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modulesUpgrade kernel-modules-extraUpgrade libperfUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade rtlaUpgrade kernel-debug-uki-virtUpgrade kernel-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-develUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-modules-extraUpgrade libperf-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-uki-virt-addonsUpgrade perfUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modulesUpgrade kernel-debuginfo-common-s390xUpgrade kernel-uki-virtUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libsUpgrade python3-perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade rvUpgrade kernel-rt-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-core | Sep 28, 2026 | Sep 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 21, 2026 | Sep 4, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub