Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 3h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 6h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 6h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 7h Vulnerability in Sparx Systems Enterprise Architect software · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilities in Slican telephone exchanges · 8h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 11h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 11h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 12h Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks · 3h NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks · 6h Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing · 6h Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules · 7h Vulnerability in Sparx Systems Enterprise Architect software · 7h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 7h Vulnerabilities in Slican telephone exchanges · 8h Palo Alto Networks waarschuwt voor misbruik van beveiligingslek in firewalls · 11h Cisco meldt actief misbruik van kritiek lek in Secure Email Gateway · 11h Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts · 12h

ACyber Sentinel Security Assessment Team

← Back to feed

⚠️ Vulnerability Report

CVE-2026-80844

NA 📌 Received

CVE-2026-80844 - xfrm: ah6: validate routing header segments_left

In the Linux kernel, the following vulnerability has been resolved:

xfrm: ah6: validate routing header segments_left

AH6 rearranges routing-header addresses before computing or verifying the

ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than

the number of addresses described by the routing header's hdrlen field.

That assumption does not hold for raw IPv6 HDRINCL packets. A packet with

hdrlen equal to 2 describes one address, but can carry an arbitrary

segments_left value. With segments_left equal to 255, the function moves

its address pointer 4,064 bytes backwards and passes a 4,064-byte length to

memmove(), resulting in an out-of-bounds access.

Validate the invariant locally before modifying the routing header or

performing any address-pointer arithmetic, and propagate malformed-header

errors to the existing AH6 input and output error paths.

Published: Sep 04, 2026 16:18

Last Modified: Sep 04, 2026 16:18