CVE-2026-98531
Received Received - Intake

Buffer Overflow in Linux Kernel IPv6 Segment Routing

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tun_src and leaked back to userspace via SEG6_CMD_GET_TUNSRC. Switch SEG6_ATTR_DST in seg6_genl_policy to NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6_addr) with -ERANGE. Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of uninitialized kernel heap memory (tun_src = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tun_src remains zeroed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98531
EUVD
EUVD-2026-103576

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa
Linux Linux 4.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the IPv6 segment routing implementation. It involves an out-of-bounds read when processing SEG6_ATTR_DST attributes. The issue occurs because the attribute length validation allows shorter payloads than required, leading to reading uninitialized memory when copying data.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 segment routing implementation. Detection requires checking kernel versions and examining netlink policy enforcement for SEG6_ATTR_DST attributes. No direct commands are provided in the context to detect this issue on a live system.

Impact Analysis

An attacker could exploit this to leak 16 bytes of uninitialized kernel memory to userspace. This could potentially expose sensitive information from kernel memory, though the practical impact depends on the system configuration and kernel version.

Mitigation Strategies

Apply the kernel patch that changes SEG6_ATTR_DST policy to NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) to enforce exact length validation. This prevents out-of-bounds reads by rejecting malformed attributes during netlink message processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98531. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart