Red Hat Enterprise Linux 9 EUVD-2026-113734

Exploitation requires the target to be running a RHEL 9.6 through 9.10 kernel build AND to have SRv6 (IPv6 Segment Routing) tunnels configured - this is a non-default networking feature, so hosts without SRv6 configured are not exposed. The vulnerable code path is seg6_input_core()'s packet drop path; the precise packet condition that forces that drop path is not described in the available sources. Upstream Linux and RHEL 10 are explicitly not affected, and RHEL 9 builds prior to the incomplete backport are outside the stated range. No authentication or user interaction is required (PR:N/UI:N), but the SRv6-configured prerequisite and the high attack complexity (AC:H) are the primary limiting factors; impact is confined to availability (denial of service), with no confidentiality or integrity effect.

This is a medium-severity, availability-only issue (CVSS 5.9). The provided CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-reachable, unauthenticated flaw, but with high attack complexity (AC:H) and impact limited to availability (C:N/I:N/A:H, scope unchanged) - there is no code execution or data exposure, only softirq starvation leading to denial of service. The high complexity aligns with the description: exploitation is only possible on RHEL 9.6-9.10 hosts that have SRv6 tunnels explicitly configured, a non-default networking feature, which materially narrows the exposed population. No EPSS score is provided in the input, so exploitation probability cannot be quantified; the issue is not in CISA KEV and no SSVC breakdown is supplied beyond the vendor priority label. The vuln.today decision label is 'this_month', i.e. a scheduled-patch priority rather than act_now/emergency. No public exploit identified at time of analysis - the two references are the Red Hat advisory and its Bugzilla entry, not proof-of-concept code. Net assessment: a legitimate but bounded DoS risk for the subset of RHEL 9 systems using SRv6, not a drop-everything emergency; the lack of EPSS/KEV data is a gap to note rather than evidence of either high or low real-world activity.

An attacker who can send IPv6 Segment Routing (SRv6) traffic to a RHEL 9.6-9.10 host that has SRv6 tunnels configured sends packets that hit the drop path in seg6_input_core(); because that path returns with bottom halves still disabled, softirq processing is starved and the system degrades into denial of service. No authentication is required, but the specific trigger beyond 'the drop path' is not described in the available sources. No public exploit identified at time of analysis.