CVE-2025-38310

What it actually does

The seg6 code validates only that provided nexthop address length does not exceed the specified length, allowing a shorter supplied length and resulting in the kernel reading uninitialized memory.

Why it matters to the business

Linux systems using IPv6 segment routing may experience information disclosure or unexpected kernel behavior; widespread kernel usage increases potential exposure across servers and devices.

How an attack unfolds

An attacker with local access supplies a seg6 nexthop address structure with a shorter length than declared, causing the kernel to read beyond the provided data into uninitialized memory; listed threat actors and related privilege-escalation campaigns targeting the Linux kernel could leverage similar memory-access flaws.

How to fix it

Upgrade linux-lts packages to the listed fixed versions: 6.1.81-r0 for Alpaquita 23, 6.6.58-r0 or 6.12.41-r0 for Alpaquita stream, and commit 668923c474608dd9ebce0fbcc41bd8a27aa73dd6 for the upstream stable tree.

How to confirm the fix worked

Verify running kernel version against the fixed releases; inspect seg6 nexthop handling code for exact length equality checks; run regression tests that supply mismatched address lengths.

Typical attack path

1. Obtain local access on a Linux system using seg6
2. Craft a netlink message or userspace call supplying a nexthop address with mismatched length
3. Trigger the validation path that performs an oversized read
4. Observe or exfiltrate uninitialized kernel memory contents

How to detect it

Review kernel logs and audit trails for seg6 netlink operations with anomalous address lengths; examine crash dumps or memory access violations around nexthop validation; correlate with listed threat actor tactics targeting kernel privilege escalation.

What your security team should do

• Apply the listed kernel updates immediately on all affected systems
• Prioritize patching internet-facing or multi-tenant Linux hosts
• Monitor EPSS trend and kernel-related exploit activity for increased urgency
• Restrict unprivileged netlink access where seg6 is enabled