{"id":"CVE-2026-98383","revision":"51a4e47925d949db8022c02a31d7ef69","records":[{"revision":"51a4e47925d949db8022c02a31d7ef69","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-98383","aliases":[],"title":"bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto().","state":0,"publishedAt":"2026-10-09T07:34:22.408+00:00","modifiedAt":"2026-10-24T14:08:40.964+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/core/filter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"0f38472a2aa8704a6b514c0dfa9c32f3672b8f32\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"cae8674489f26edf7553fdd660599466cbb4c32f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"9f9e57b5a3a033f95f49ef9d541340cdbcb80abb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"df0072be6fc373cb22f9ea854d458b04e32a03cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"b9bb0e735460751b620156f800a4279a28573392\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"37b18688cd18fd86d2f35c212df1611862a26cd5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"fca71ead7a20290af1e2046983eeafae43d21af1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"004d4b274e2a1a895a0e5dc66158b90a7d463d44\",\n                            \"lessThan\": \"e4a62833adff6ef0fe7c0b90393204fe3c26b5c5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/core/filter.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32","https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f","https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb","https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf","https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392","https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5","https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1","https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98383","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98383","identifiers":["CVE-2026-98383"]},"retained":false,"historicalAffected":[]}],"coverage":[]}