CVE-2026-89783
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check in xfrm6_input_addr() is off by one: if (1 + sp->len == XFRM_MAX_DEPTH) goto drop; ... sp->xvec[sp->len++] = x; xfrm_input() can leave sp->len == XFRM_MAX_DEPTH, and the transport-mode receive path re-enters IPv6 input via xfrm_trans_reinject() with that secpath preserved. If the inner packet carries a destination-options HAO option or a type-2 routing header, xfrm6_input_addr() is called with sp->len == XFRM_MAX_DEPTH; the check (1 + 6 == 6) is false, so sp->xvec[sp->len++] writes one slot past the 6-element xvec[]. The write stays within the sec_path allocation (invisible to KASAN); UBSAN_BOUNDS flags it and panics under panic_on_warn. Use "sp->len >= XFRM_MAX_DEPTH", matching xfrm_input(). This also restores one chain level the old check rejected at sp->len == 5. UBSAN: array-index-out-of-bounds in net/ipv6/xfrm6_input.c:309:10 index 6 is out of range for type 'xfrm_state *[6]'
How to fix
- Linux Linux91fc387f63c00ddfb5221127a17bac97549a8343, 68e8737fe8e72f085c608cff322b3d2de8340af1, 8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77, bdcda866c89f9a8b1acdabf02d26cde9fbe501d8, 48996649222e95008cdb98cd58579e3fc8e5ee06, 0f679e0523ddfff3fb554336ceb874b0e51e9cd3, 5f35a29a5eed3d80befd32050843ac88dea3d61a, 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 91fc387f63c00ddfb5221127a17bac97549a8343, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 68e8737fe8e72f085c608cff322b3d2de8340af1, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < bdcda866c89f9a8b1acdabf02d26cde9fbe501d8, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 48996649222e95008cdb98cd58579e3fc8e5ee06, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 0f679e0523ddfff3fb554336ceb874b0e51e9cd3, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 5f35a29a5eed3d80befd32050843ac88dea3d61a, 9473e1f631de339c50bde1e3bd09e1045fe90fd5 ≤ v < 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc, 2.6.25 | 91fc387f63c00ddfb5221127a17bac97549a8343, 68e8737fe8e72f085c608cff322b3d2de8340af1, 8fe2c53fb81f5ad5be43af2ad09583f7c78b4b77, bdcda866c89f9a8b1acdabf02d26cde9fbe501d8, 48996649222e95008cdb98cd58579e3fc8e5ee06, 0f679e0523ddfff3fb554336ceb874b0e51e9cd3, 5f35a29a5eed3d80befd32050843ac88dea3d61a, 5d9e3bf34fec9a5d237e4b7cef4a707bc2e091bc |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.