CVE-2026-118593: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-118593 is a kernel denial-of-service vulnerability in Red Hat Enterprise Linux 9 caused by an incomplete backport of the CVE-2026-46099 fix. Specifically, RHEL 9.6 through 9.10 kernel builds contain a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled, leading to softirq starvation on systems with SRv6 tunnels configured. Upstream Linux and RHEL 10 are not affected. It was published on October 30, 2026, and carries a CVSS v3.1 base score of 5.9 (Medium) (Red Hat Advisory, Github Advisory).

The root cause is classified as CWE-667 (Improper Locking). RHEL 9.6–9.10 kernel trees include upstream commit c0b98ac1cc10 (which introduced local_bh_disable() across the cache miss/route-input path in seg6_input_core()) and the CVE-2026-46099 fix hunk, but are missing upstream commit 40475b63761a (net: ipv6: seg6_iptunnel: mitigate 2-realloc issue), which narrows BH disable to dst_cache_* calls so error paths are not responsible for re-enabling BH. As a result, the NULL dst check added by the CVE-2026-46099 fix can jump to the drop label while bottom halves are still disabled, causing softirq starvation, lockdep splats, and potential system hangs. Exploitation requires an attacker to send specially crafted packets that trigger a routing lookup failure in the SRv6 tunnel subsystem on an affected host (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in softirq starvation and denial of service — the affected system may become unresponsive or hang without any compromise of confidentiality or integrity. The attack is limited to systems where SRv6 (Segment Routing over IPv6) tunneling is actively configured, which is not the default, restricting the affected population to specialized routing deployments. There is no risk of data exfiltration or privilege escalation; the sole impact is availability (Red Hat Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is approximately 0.199%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity — specifically, the ability to send crafted network packets to a system with SRv6 tunnels configured, which is an atypical network setup (Red Hat Advisory).

1. Reconnaissance: Identify RHEL 9.6–9.10 systems (or OpenShift nodes using RHEL CoreOS 9) that have SRv6 (Segment Routing over IPv6) tunnels configured and are reachable over the network.
2. Craft malicious packets: Construct IPv6 packets with SRv6 routing headers designed to trigger a routing lookup failure (e.g., a NULL dst result after ip6_route_input() + skb_dst_force()) within seg6_input_core().
3. Send packets to target: Transmit the crafted packets to the target system's SRv6 tunnel interface. No authentication or prior access is required.
4. Trigger BH imbalance: The malformed packet causes the kernel to follow the goto drop path in seg6_input_core() while local_bh_disable() is still in effect, leaving bottom halves disabled.
5. Achieve DoS: Repeated triggering of this condition causes softirq starvation, leading to system hangs, lockdep splats, or an unresponsive kernel (Red Hat Bugzilla, Red Hat Advisory).

• Logs: Kernel lockdep splats or warnings in /var/log/messages or dmesg referencing seg6_input_core() or BH (bottom half) imbalance; messages such as SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected.
• System Behavior: Sudden increase in CPU usage with minimal network throughput on systems with SRv6 tunnels; system becoming unresponsive or hanging without obvious cause.
• Network: Unusual volume of IPv6 packets with SRv6 routing headers (Next Header type 43, Routing Type 4) arriving at SRv6 tunnel interfaces from unexpected sources.
• Kernel: Kernel oops or BUG traces in dmesg related to net/ipv6/seg6_iptunnel.c (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and a patch is available (backport of upstream commit 40475b63761a or equivalent fix ensuring every path to the drop label in seg6_input_core() runs with BH enabled). Administrators should update affected RHEL 9 kernel packages to a fixed version beyond 9.10. As an interim workaround, disabling or removing SRv6 tunnel configurations on affected systems eliminates the attack surface entirely, since the vulnerability only manifests when SRv6 tunneling is active. Monitoring for signs of softirq starvation (increased CPU usage with low throughput, kernel lockups) is also recommended (Red Hat Advisory, Red Hat Bugzilla).

Red Hat has rated this vulnerability as Moderate severity, noting that exploitation requires an atypical SRv6 network setup and can only lead to denial of service, with no impact on confidentiality or integrity. The vulnerability was noted on infosec.exchange and tracked by standard vulnerability aggregators shortly after disclosure, but has not generated significant broader community discussion given its limited scope and moderate severity (Red Hat Advisory).