Linux Kernel IPv6 Routing Header Vulnerability Enables Local Privilege Escalation
A local privilege escalation vulnerability in the Linux Kernel's IPv6 AH routing header implementation allows attackers with low-privileged code execution to gain elevated privileges.
A critical vulnerability has been identified within the Linux Kernel's handling of IPv6 AH (Authentication Header) routing headers, enabling local privilege escalation. The flaw, assigned CVE-2026-80844 by Zero Day Initiative (ZDI), allows attackers who already possess the ability to execute low-privileged code on a target system to elevate their privileges to that of the kernel.
The vulnerability stems from an integer underflow condition that occurs during the parsing of specific IPv6 routing header types. Specifically, the kernel fails to adequately validate user-supplied data within the ipv6_rt_hdr structure. This lack of proper validation can lead to an integer underflow before a buffer is allocated, creating a situation where an attacker can manipulate memory to achieve arbitrary code execution within the kernel's context.
With the ability to execute code as the kernel, an attacker could bypass all security restrictions on the system, potentially leading to complete compromise. This could involve disabling security software, exfiltrating sensitive data, installing persistent backdoors, or further spreading within a network. The CVSS score of 8.8 highlights the severity and potential impact of this vulnerability.
Zero Day Initiative reported the vulnerability to the vendor, and a coordinated public release of the advisory occurred on October 29, 2026. The Linux kernel project has since issued a fix for this issue. Developers can find the specific patch in the Linux kernel's commit history, referenced by the commit hash 7bad4bda74dc4713f398d3b7624ff05478e3a568.
While the vulnerability requires local access, meaning an attacker must first gain a foothold on the system, its presence in the core Linux kernel makes it a significant concern for administrators. Systems running unpatched versions of the Linux kernel are potentially at risk. Users and organizations are strongly advised to apply the available updates as soon as possible to mitigate the threat.
This discovery underscores the ongoing challenges in securing complex operating system kernels. Even with extensive testing and development, subtle flaws in network protocol handling can emerge, posing risks to a wide range of systems. The timely disclosure and patching by the Linux kernel community are crucial in preventing widespread exploitation of such vulnerabilities.