Linux fixes SRv6 decap flaw causing IPv6 out-of-bounds read

The Linux kernel has fixed CVE-2026-80976, a Segment Routing over IPv6 (SRv6) bug in which decapsulation left stale IPv6 control-block state on the inner packet and triggered an out-of-bounds read in the IPv6 input path.

SRv6 local endpoints such as End.DX6 and End.DT6 pull the outer headers and pass the inner IPv6 packet straight into normal IPv6 receive processing. The control block still carried values gathered while parsing the outer packet, including a large next-header offset and extension-header flags. Delivery code then applied that offset to the shorter inner packet and read beyond the buffer head. KASAN reported the slab out-of-bounds access.

An unprivileged user in their own user and network namespace could hit the path by installing a local SID and injecting an outer packet with Hop-by-Hop and Destination Options headers, an SRH, and a minimal inner IPv6 packet. The fix clears the control block after decapsulation, restores the incoming interface index and L3-slave state needed for VRF, and sets the next-header offset from the inner base header.

The flaw dates to the 4.14 series and is corrected in current stable kernel updates.