# CVE-2026-118593: CVE-2026-118593

Status: published. Published: 2026-10-30. Updated: 2026-11-01.

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-667

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-118593 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2563095 (secalert@redhat.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-118593; retrieved 2026-11-02; source updated 2026-11-01

Revision: 86205e10ae33481471c8c89886ee7b95496be614b1d991b7a0ff8b72846fd87a

Canonical: https://y2.dev/cve/CVE-2026-118593