{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98383", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.345Z", "datePublished": "2026-10-09T07:34:22.408Z", "dateUpdated": "2026-10-24T14:08:40.964Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:40.964Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The local bpf(BPF_PROG_LOAD) path reaches check_helper_call() and the patched lwt_seg6local_func_proto(), where attacker-authored bytecode requests bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data(); an RTM_NEWROUTE then attaches it. A received SRH packet merely executes that installed program and cannot create the unsafe helper sequence.\nAC:L - The attacker controls the helper order, SRH offset and length, and can inject a large non-linear SRv6 frame so bpf_skb_pull_data() deterministically reaches __pskb_pull_tail() and pskb_expand_head(). No race is required, and repeated packets reproduce the stale-pointer write.\nPR:L - bpf_prog_load() requires CAP_BPF and CAP_NET_ADMIN for BPF_PROG_TYPE_LWT_SEG6LOCAL, but BPF_F_TOKEN_FD and bpf_token_capable() support delegating both into a user namespace; rtnetlink_rcv_msg() separately accepts CAP_NET_ADMIN in the route's network namespace. Thus a host-unprivileged token holder can perform the complete setup.\nUI:N - The attacker loads the program, installs the End.BPF route, and injects the triggering SRv6 frame without any victim action.\nS:U - The stale srh pointer and resulting corruption occur in the same host kernel that processes the attacker's BPF program and packet; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - After skb->head is freed, seg6_bpf_has_valid_srh() passes the dangling srh pointer to seg6_validate_srh(), which reads header fields and variable-length TLVs from reusable slab memory; its drop-versus-forward result also provides an observable contents oracle.\nI:H - seg6_bpf_has_valid_srh() executes srh->hdrlen = srh_state->hdrlen >> 3 through the dangling pointer, producing an attacker-valued one-byte write into freed slab memory that can corrupt a reclaimed object or allocator state and support control-flow compromise.\nA:H - The stale write in seg6_bpf_has_valid_srh() is a confirmed slab use-after-free and can trigger a KASAN panic or later kernel oops through corrupted freed-object state; the attacker can repeat it with additional packets." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/filter.c" ], "versions": [ { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "b9bb0e735460751b620156f800a4279a28573392", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1", "status": "affected", "versionType": "git" }, { "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/filter.c" ], "versions": [ { "version": "4.18", "status": "affected" }, { "version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.271" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.222" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32" }, { "url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f" }, { "url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb" }, { "url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf" }, { "url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392" }, { "url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5" }, { "url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1" }, { "url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5" } ], "title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL", "x_generator": { "engine": "bippy-1.2.0" } } } }