CVE-2026-89783

A flaw of Moderate impact was found in the Linux kernel's IPv6 XFRM input processing. The depth check in xfrm6_input_addr() is off by one: when a transport-mode receive path re-enters IPv6 input via xfrm_trans_reinject() with a security path (secpath) that is already full, and the inner IPv6 packet carries a destination-options Home Address (HAO) option or a type-2 routing header, the function writes one pointer past the end of the six-element xvec array. A remote attacker could exploit this flaw by sending specially crafted IPv6 packets to an affected system, causing a kernel panic and resulting in a denial of service; on systems with panic_on_warn enabled, the out-of-bounds access triggers a UBSAN array-index-out-of-bounds report and a subsequent panic. Red Hat Product Security assesses this flaw as Moderate, lower than the Critical severity assigned in the upstream CVE record (CVSS 9.8), because triggering the out-of-bounds write requires a highly specific crafted IPv6 packet structure, the write stays within the surrounding sec_path allocation, and the demonstrated consequence is a system crash rather than exposure of sensitive data. Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift Container Platform are affected, and fixes are being pursued for these products. Red Hat Enterprise Linux 6 is out of support scope for this flaw.