CVE-2026-118593— Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux 10

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Red Hat Enterprise Linux 9 的内核构建中发现了一个缺陷。在 RHEL 9.6 至 9.10 中，对 CVE-2026-46099 的修复补丁进行了不完整的回移植，导致函数中出现了本地底半部（local_bh）的不平衡问题：在丢弃路径中，函数在底半部仍处于禁用状态时即返回。这可能导致软中断饥饿，进而使配置了 SRv6 隧道的系统发生拒绝服务（DoS）。上游内核和 RHEL 10 不受此问题影响。

CVSS 5.9 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

加锁机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/o:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 6	-	`cpe:/o:redhat:enterprise_linux:6`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 7	-	`cpe:/o:redhat:enterprise_linux:7`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 8	-	`cpe:/o:redhat:enterprise_linux:8`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/o:redhat:enterprise_linux:9`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 5	-	`cpe:/a:redhat:openshift:5`

II. Public POCs for CVE-2026-118593

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118593

请登录查看更多情报信息。

Other References for CVE-2026-118593 (2)

https://access.redhat.com/security/cve/CVE-2026-118593 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2563095 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-118593

Same Patch Batch · Red Hat · 2026-10-30 · 13 CVEs total

CVE-2026-103963	7.5 HIGH	Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows r
CVE-2026-115455	6.5 MEDIUM	Gcc: stack overflow in std::bitset on libstdc++
CVE-2026-118952	6.5 MEDIUM	Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization ru
CVE-2026-91920	6.5 MEDIUM	Undertow: undertow: chunkreader message length permits chunk-size overflow
CVE-2026-114690	6.2 MEDIUM	Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
CVE-2026-114691	5.9 MEDIUM	Gcc: integer wrap in `std
CVE-2026-110133	5.8 MEDIUM	Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal int
CVE-2026-118959	5.4 MEDIUM	Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
CVE-2026-118947	4.3 MEDIUM	Keycloak-services: keycloak-services: authorization bypass via uma resource registration i
CVE-2026-115456	3.7 LOW	Gcc: out-of-bounds read in std::from_chars
CVE-2026-118475	3.6 LOW	Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp
CVE-2026-112922	3.3 LOW	Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of in

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10

Same vendor: Red Hat

Same weakness: CWE-667