CVE-2026-80840: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-56f8-x2fw-63m3
Share
Published
Advisory Summary

CVE-2026-80840 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-80840 at a Glance

CVE Identifier CVE-2026-80840
GHSA Identifier GHSA-56f8-x2fw-63m3
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-80840

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-80840, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control block on IPIP decapsulation End.DX4 and End.DT4 decapsulate an IPv4 packet through decap_and_validate() and send it directly to IPv4 routing. The inner packet therefore bypasses ip_rcv_core(), which normally clears IPCB before IPv4 interprets skb->cb. The skb instead retains IP6CB data from the outer packet. IP6CB and IPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps IPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and ts. The sender can make the stale optlen byte nonzero with a valid outer extension-header chain. The reproducers put an eight-byte Destination Options header immediately after the 40-byte IPv6 header and before the Segment Routing Header. ipv6_destopt_rcv() records the sender-controlled Destination Options offset in both lastopt and nhoff, setting them to 40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees optlen = 40 and rr = 40. Both tcp_v4_save_options() and __ip_options_echo() skip option copying when optlen is zero. Here optlen is 40, so the TCP SYN path allocates room for 40 bytes of option data and calls __ip_options_echo(). The stale rr value makes that function read inner packet byte 41 as the Record Route option length. The reproducers set that sender-controlled byte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte option-data area. Separate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5 kernel both produced: BUG: KASAN: slab-out-of-bounds in __ip_options_echo() Write of size 255 The relevant End.DX4 call path is: __ip_options_echo tcp_v4_route_req tcp_conn_request tcp_v4_conn_request tcp_rcv_state_process tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish ip_local_deliver input_action_end_dx4_finish input_action_end_dx4 The relevant End.DT4 call path is: __ip_options_echo tcp_v4_route_req tcp_conn_request tcp_v4_conn_request tcp_rcv_state_process tcp_v4_do_rcv tcp_v4_rcv ip_protocol_deliver_rcu ip_local_deliver_finish ip_local_deliver input_action_end_dt4 tcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so it does not appear as a separate frame. When decap_and_validate() handles IPPROTO_IPIP, save the ingress interface from IP6CB, clear IPCB, and restore the saved value. Doing this in the common decapsulation path covers End.DX4, End.DT4, and End.DT46's IPv4 arm. Use IP6CB(skb)->iif rather than skb->skb_iif. These actions run after l3mdev processing, which can replace skb_iif with the L3 master; IP6CB iif still records the receiving interface set at IPv6 ingress.

References

NVD — CVE-2026-80840 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80840
git.kernel.org/stable/c/0e3f01fe2e... WEB
https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c
git.kernel.org/stable/c/10fd1a8f58... WEB
https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667
git.kernel.org/stable/c/3e4476e583... WEB
https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf
git.kernel.org/stable/c/44930446dd... WEB
https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646
git.kernel.org/stable/c/9039e4f3e1... WEB
https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c
git.kernel.org/stable/c/bf1c115156... WEB
https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7
git.kernel.org/stable/c/eb0f422487... WEB
https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa
git.kernel.org/stable/c/f4be3b3912... WEB
https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33
git.kernel.org/stable/c/f52f1e7571... WEB
https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8

Frequently Asked Questions

What is CVE-2026-80840?
CVE-2026-80840 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-80840?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-80840?
CVE-2026-80840 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-80840?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-56f8-x2fw-63m3",
  "modified" : "2026-09-04T18:31:28Z",
  "published" : "2026-09-04T18:31:28Z",
  "aliases" : [ "CVE-2026-80840" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: seg6: clear IPv4 control block on IPIP decapsulation\n\nEnd.DX4 and End.DT4 decapsulate an IPv4 packet through\ndecap_and_validate() and send it directly to IPv4 routing. The inner\npacket therefore bypasses ip_rcv_core(), which normally clears IPCB\nbefore IPv4 interprets skb->cb.\n\nThe skb instead retains IP6CB data from the outer packet. IP6CB and\nIPCB use the same skb->cb storage, so IP6CB(skb)->lastopt overlaps\nIPCB(skb)->opt.optlen and srr, while IP6CB(skb)->nhoff overlaps rr and\nts.\n\nThe sender can make the stale optlen byte nonzero with a valid outer\nextension-header chain. The reproducers put an eight-byte Destination\nOptions header immediately after the 40-byte IPv6 header and before the\nSegment Routing Header. ipv6_destopt_rcv() records the sender-controlled\nDestination Options offset in both lastopt and nhoff, setting them to\n40. On the reproduced little-endian x86-64 kernel, IPv4 therefore sees\noptlen = 40 and rr = 40.\n\nBoth tcp_v4_save_options() and __ip_options_echo() skip option copying\nwhen optlen is zero. Here optlen is 40, so the TCP SYN path allocates\nroom for 40 bytes of option data and calls __ip_options_echo(). The\nstale rr value makes that function read inner packet byte 41 as the\nRecord Route option length. The reproducers set that sender-controlled\nbyte to 255, so __ip_options_echo() copies 255 bytes into the 40-byte\noption-data area.\n\nSeparate End.DX4 and End.DT4 reproducers on the unpatched v7.2-rc5\nkernel both produced:\n\n  BUG: KASAN: slab-out-of-bounds in __ip_options_echo()\n  Write of size 255\n\nThe relevant End.DX4 call path is:\n\n  __ip_options_echo\n  tcp_v4_route_req\n  tcp_conn_request\n  tcp_v4_conn_request\n  tcp_rcv_state_process\n  tcp_v4_do_rcv\n  tcp_v4_rcv\n  ip_protocol_deliver_rcu\n  ip_local_deliver_finish\n  ip_local_deliver\n  input_action_end_dx4_finish\n  input_action_end_dx4\n\nThe relevant End.DT4 call path is:\n\n  __ip_options_echo\n  tcp_v4_route_req\n  tcp_conn_request\n  tcp_v4_conn_request\n  tcp_rcv_state_process\n  tcp_v4_do_rcv\n  tcp_v4_rcv\n  ip_protocol_deliver_rcu\n  ip_local_deliver_finish\n  ip_local_deliver\n  input_action_end_dt4\n\ntcp_v4_save_options() is inlined into the tcp_v4_route_req() path, so\nit does not appear as a separate frame.\n\nWhen decap_and_validate() handles IPPROTO_IPIP, save the ingress\ninterface from IP6CB, clear IPCB, and restore the saved value. Doing\nthis in the common decapsulation path covers End.DX4, End.DT4, and\nEnd.DT46's IPv4 arm.\n\nUse IP6CB(skb)->iif rather than skb->skb_iif. These actions run after\nl3mdev processing, which can replace skb_iif with the L3 master;\nIP6CB iif still records the receiving interface set at IPv6 ingress.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80840"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0e3f01fe2e704e76af4385b8a1742641885a191c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/10fd1a8f58ac619a9e251f2858e2e2c8fd6cd667"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/3e4476e58343fb8f2fffced9e22d935376b17aaf"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/44930446dde45a7a90fe1446fa38eb0e2c561646"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9039e4f3e1c0ffe2b575b655b3f58fdd10f7e40c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bf1c1151560d11036a144d917fa4c131831342d7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/eb0f422487228e140f3d609b032ac61aedcab8fa"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f4be3b391265e24c7720fc867c50062b436acf33"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/f52f1e75716d2ee49e013edf204ac92337c72fd8"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-04T16:18:12Z"
  }
}