CVE-2026-118593 Red Hat CVE debrief

Who should care

Red Hat Enterprise Linux 9 system administrators and security teams, especially those with SRv6 tunnels configured, should verify and apply patches promptly to prevent potential denial of service.

Why it matters

CVE-2026-118593 is a medium-severity vulnerability in Red Hat Enterprise Linux 9 kernel builds that can lead to denial of service on systems with SRv6 tunnels configured; Red Hat Enterprise Linux 9 system administrators and security teams should verify and apply patches promptly.

• Denial of service on systems with SRv6 tunnels configured
• Potential for softirq starvation
• Need for verification of patch application and system configuration

Technical summary

An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), leading to softirq starvation and denial of service on systems with SRv6 tunnels configured. The vulnerability has a medium severity and requires prompt verification and patch application by Red Hat Enterprise Linux 9 system administrators and security teams, especially those with SRv6 tunnels configured. The issue arises from a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled.

Defensive priority

Medium priority for Red Hat Enterprise Linux 9 systems with SRv6 tunnels configured; verify and apply patches promptly.

Recommended defensive actions

• Verify Red Hat Enterprise Linux 9 systems for SRv6 tunnels configuration
• Check for and apply available patches from Red Hat
• Monitor systems for signs of softirq starvation and denial of service
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide details on the vulnerability; however, further verification is needed to determine the full scope of affected systems and potential impact. The incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(). Red Hat Enterprise Linux 9 system administrators and security teams should verify and apply patches promptly to prevent potential denial of service. The vulnerability can lead to softirq starvation and denial of service on systems with SRv6

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.