What’s Vulnerable › Vulnerabilities

CVE-2026-118593: Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-30 · updated 2026-10-30
• Weakness: CWE-667

Description

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat OpenShift Container Platform 5: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-118593
• https://bugzilla.redhat.com/show_bug.cgi?id=2563095

Get alerted when CVE-2026-118593 or the next vulnerability affects your stack