CVE-2026-118593 in Linux
Summary
by MITRE • 10/30/2026
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified as CVE-2026-46099 within Red Hat Enterprise Linux versions 9.6 through 9.10 stems from an incomplete backport of a kernel fix, resulting in a critical state imbalance in the Segment Routing over IPv6 implementation. Specifically, the flaw resides in the seg6_input_core function where the error handling path fails to properly re-enable bottom halves after they were disabled for atomic context safety. In Linux kernel networking stacks, bottom halves are software interrupts that handle deferred processing of network packets and other asynchronous events. When these are left disabled without being restored, it creates a local_bh imbalance that prevents the scheduler from executing pending soft interrupt handlers effectively.
This technical defect leads directly to softirq starvation on affected systems. Soft IRQs are responsible for critical networking tasks such as packet transmission completion, timer management, and network interface polling. By leaving bottom halves disabled in this specific code path, the kernel becomes unable to process these deferred interrupts efficiently. The operational impact is a severe degradation of system performance that can escalate into a complete denial of service condition. Systems configured with SRv6 tunnels are particularly susceptible because they rely heavily on timely processing of segment routing headers and associated control plane messages. If an attacker or even normal traffic patterns trigger the flawed code path repeatedly, the accumulation of unprocessed soft interrupts will exhaust CPU resources dedicated to networking tasks, effectively freezing network connectivity and potentially impacting other system services that depend on timer-based scheduling.
From a classification perspective, this vulnerability aligns with CWE-401 which describes missing release of lock or resource after acquisition, although in this specific kernel context it manifests as a state management error regarding interrupt handling contexts rather than traditional mutex locks. It also relates to CWE-755 related to improper handling of unusual or exceptional conditions within the operating system's core logic. The attack vector is primarily local, requiring an entity with access to trigger network operations involving SRv6 tunnels, which could be achieved through crafted packet injection if remote code execution privileges are not required but rather just sufficient permissions to send traffic on configured interfaces.
Mitigation strategies must focus on immediate patching as upstream kernels and Red Hat Enterprise Linux 10 do not contain this flaw due to proper implementation of the fix. Administrators should apply the latest errata packages for RHEL 9 that include the corrected seg6_input_core logic which ensures bottom halves are correctly re-enabled upon exiting error paths. Until patches are applied, network administrators can consider disabling SRv6 tunnel configurations on critical systems if they are not strictly required to reduce the attack surface and prevent triggering of the vulnerable code path. Monitoring for unusual CPU usage spikes associated with softirq processing may also serve as an early detection mechanism for exploitation attempts or accidental triggers causing denial of service conditions.