In the Linux kernel

CVE-2026-80844 — nicknamed DirtyAH6 — is an out-of-bounds write in the Linux kernel's IPv6 Authentication Header (ah6) processing. The function ipv6_rearrange_rthdr() trusts that the segments_left field in a Type 0 routing header never exceeds the address count implied by hdrlen. A raw IPv6 HDRINCL socket can send a packet with hdrlen=2 (one address) but segments_left=255, causing the pointer to rewind 4,064 bytes before a memmove() call. This corrupts adjacent kernel heap structures. The bug has existed since Linux 2.6.12 (2005) and affects every unpatched kernel through 7.2.2. Fixed in stable branches: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4.

There is no vendor CVSS score for this CVE — NVD has not published an analysis. The researcher's PoC (github.com/manizada/DirtyAH6) demonstrates local privilege escalation to root on Fedora 43 and Ubuntu 24.04 via unprivileged user namespaces, which are enabled by default on those distros. Remote exploitation is theoretically possible against IPv6 routers running AH transport mode, but the researcher calls remote RCE *extremely difficult* and limits the remote impact to denial-of-service. noisgate assesses this as HIGH / 7.8 — the public PoC, universal kernel footprint, and high-value-role blast radius (hypervisors, k8s nodes, CI runners) prevent a downgrade below HIGH, but the local-access prerequisite and kernel-specific PoC tuning prevent CRITICAL.

Why this verdict

• Public PoC with demonstrated root: The DirtyAH6 PoC on GitHub achieves local-to-root on two mainstream distros. Even though it requires per-kernel tuning, weaponization by a skilled actor is realistic within weeks.
• Universal kernel footprint: The bug spans 21 years of Linux kernels (2.6.12 to 7.2.2). Every unpatched Linux host in the fleet — physical, virtual, containerized — is theoretically in scope.
• Role multiplier: The Linux kernel is canonically deployed in high-value roles. On a KVM/QEMU hypervisor host, root = VM escape pathway. On a Kubernetes worker node, root = access to all pod secrets, kubelet creds, and lateral movement to the control plane. On a CI/CD runner, root = supply-chain pivot via build artifact tampering. On a production database server, root = full data exfiltration. These roles represent well over 10% of the installed Linux base, establishing a HIGH floor.
• Unprivileged user namespaces lower the bar: On Ubuntu and Fedora — two of the most common enterprise desktop and server distros — unprivileged userns are enabled by default, meaning any local user can reach the vulnerable code path without prior CAP_NET_RAW.
• Friction adjustment — local access required (no downgrade past floor): The chain requires post-initial-access positioning. The attacker must already have a shell. This is significant friction that would otherwise push toward MEDIUM, but the role-multiplier floor prevents descent below HIGH.

Why not higher?

CRITICAL would require either active in-the-wild exploitation (KEV-listed), a reliable remote code execution path, or a one-click/zero-click chain. DirtyAH6 requires local access and kernel-specific heap grooming that may crash the host. The researcher explicitly calls remote RCE *extremely difficult*. The PoC is fragile and tuned to two specific kernels — broader weaponization requires non-trivial effort.

Why not lower?

MEDIUM would require the blast radius to be limited to low-value roles or the exploit path to be largely theoretical. Neither applies: the PoC is public and functional, the affected component is the kernel itself (not a userspace application), and the high-value-role floor (hypervisors, k8s, CI/CD) is binding. A 21-year-old bug with a working PoC in the most privileged software layer on the host cannot be MEDIUM.

1. Disable unprivileged user namespaces — Set sysctl kernel.unprivileged_userns_clone=0 (or user.max_user_namespaces=0 on RHEL). This blocks the PoC's entry point by preventing unprivileged users from obtaining CAP_NET_RAW. Deploy within 30 days per the noisgate mitigation SLA for HIGH. On Ubuntu ≥24.04, also review AppArmor userns restrictions.
2. Restrict ah6 module loading — If your environment does not use IPsec AH with IPv6, blacklist the ah6 module: echo 'install ah6 /bin/false' > /etc/modprobe.d/disable-ah6.conf. This removes the vulnerable code path entirely. Verify with modprobe -n -v ah6. Deploy within 30 days.
3. Enable SELinux enforcing mode — SELinux in enforcing mode with targeted policy blocks the PAM file overwrite that the PoC uses for its final escalation step. This does not prevent the OOB write itself but breaks the specific post-exploitation chain.
4. Deploy FIM on critical auth files — File integrity monitoring on /etc/pam.d/, /etc/shadow, and /etc/sudoers will alert on the PoC's payload. Tools: AIDE, OSSEC, Wazuh, or your EDR's FIM module.
5. Audit namespace creation — Add auditd rules: -a always,exit -F arch=b64 -S unshare -F a0&=0x10000000 -k userns_create. Forward to SIEM for alerting on unexpected user namespace creation outside known container orchestrators.

Run on each target Linux host as any user (no root required). Invoke: bash check_cve_2026_80844.sh. Checks the running kernel version against known-fixed stable branches and reports VULNERABLE, PATCHED, or UNKNOWN. Also checks for compensating controls (userns disabled, ah6 blacklisted).

#!/bin/bash
# check_cve_2026_80844.sh — DirtyAH6 kernel version check
# Run on target Linux host. No root required.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
# Extract major.minor.patch from kernel version string
VER=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VER" ]; then
  echo "UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

# version_gte: returns 0 if $1.$2.$3 >= $4.$5.$6
version_gte() {
  [ "$1" -gt "$4" ] && return 0
  [ "$1" -lt "$4" ] && return 1
  [ "$2" -gt "$5" ] && return 0
  [ "$2" -lt "$5" ] && return 1
  [ "$3" -ge "$6" ] && return 0
  return 1
}

# Fixed versions per stable branch:
# 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
PATCHED=false

if [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 10 ]; then
  version_gte $MAJOR $MINOR $PATCH 5 10 270 && PATCHED=true
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 15 ]; then
  version_gte $MAJOR $MINOR $PATCH 5 15 221 && PATCHED=true
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ]; then
  version_gte $MAJOR $MINOR $PATCH 6 1 188 && PATCHED=true
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 6 ]; then
  version_gte $MAJOR $MINOR $PATCH 6 6 157 && PATCHED=true
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 12 ]; then
  version_gte $MAJOR $MINOR $PATCH 6 12 109 && PATCHED=true
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 18 ]; then
  version_gte $MAJOR $MINOR $PATCH 6 18 50 && PATCHED=true
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 2 ]; then
  version_gte $MAJOR $MINOR $PATCH 7 2 4 && PATCHED=true
elif [ "$MAJOR" -ge 8 ]; then
  PATCHED=true  # Future kernels assumed patched
else
  # Kernels on non-stable branches (e.g. 6.2.x-6.5.x, 6.7.x-6.11.x) are EOL
  # and likely vulnerable unless distro-backported
  echo "UNKNOWN — kernel $KERNEL is on a non-LTS branch. Check your distro advisory."
  exit 2
fi

# Also check if ah6 module is even loadable
AH6_STATUS="loadable"
if grep -q 'install ah6 /bin/false' /etc/modprobe.d/*.conf 2>/dev/null; then
  AH6_STATUS="blacklisted"
elif ! modinfo ah6 >/dev/null 2>&1; then
  AH6_STATUS="not_available"
fi

# Check unprivileged userns
USERNS="unknown"
if [ -f /proc/sys/kernel/unprivileged_userns_clone ]; then
  USERNS=$(cat /proc/sys/kernel/unprivileged_userns_clone)
elif [ -f /proc/sys/user/max_user_namespaces ]; then
  VAL=$(cat /proc/sys/user/max_user_namespaces)
  [ "$VAL" -eq 0 ] && USERNS="0" || USERNS="$VAL"
fi

if $PATCHED; then
  echo "PATCHED — kernel $KERNEL is at or above the fix level."
  echo "  ah6 module: $AH6_STATUS"
  echo "  unprivileged userns: $USERNS"
  exit 0
else
  echo "VULNERABLE — kernel $KERNEL is below the fix for CVE-2026-80844 (DirtyAH6)."
  echo "  ah6 module: $AH6_STATUS (blacklisted = mitigated)"
  echo "  unprivileged userns: $USERNS (0 = mitigated)"
  [ "$AH6_STATUS" = "blacklisted" ] || [ "$USERNS" = "0" ] && \
    echo "  NOTE: Compensating control detected — exploit path likely blocked."
  exit 1
fi

Sources

1. OSV Advisory — CVE-2026-80844
2. OpenCVE — CVE-2026-80844
3. DirtyAH6 PoC — Manizada
4. Kernel Patch (netdev mailing list)
5. GBHackers — 4 Linux Kernel LPE Flaws
6. SecurityOnline — Linux Kernel LPE Quartet
7. RHSA-2026:19568 — Red Hat Errata
8. CyberStrike — CVE-2026-80844