Cloudanix VulnDB

CVE-2026-98306

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug could let traffic meant for one isolated network segment reach applications in another segment instead, breaking the intended separation between those networks.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Other
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing IPSKB_L3SLAVE flag propagation during IPv4 IPIP decapsulation in seg6 allows socket lookup to ignore VRF enslavement, causing decapsulated packets to match sockets outside the intended VRF or fail to match bound sockets inside it.

Why it matters to the business

Network traffic intended for a specific VRF may reach applications outside that VRF or be dropped, violating network segmentation and potentially exposing services or allowing unauthorized access across isolated network domains.

How an attack unfolds

An attacker sends crafted SRv6 packets arriving on a VRF-enslaved interface; after decapsulation the missing flag causes the kernel to perform socket lookup without VRF context, delivering the packet to an unbound socket in the default VRF or preventing delivery to a socket bound inside the VRF, bypassing the documented VRF scoping rules.

How to fix it

Apply the upstream fix that sets IPSKB_L3SLAVE from IP6SKB_L3SLAVE inside decap_and_validate for IPv4; rebuild and deploy the patched kernel; ensure udp_l3mdev_accept and tcp_l3mdev_accept remain at their secure defaults unless explicitly required.

How to confirm the fix worked

Confirm the presence of the commit that sets IPSKB_L3SLAVE in decap_and_validate; test by binding a UDP/TCP socket to an enslaved interface inside a VRF and verifying that only packets arriving on that VRF are accepted while default-VRF sockets reject them.

Typical attack path

  1. Attacker transmits SRv6-encapsulated IPv4 packet targeting an End.DX4 segment on a VRF-enslaved interface
  2. vrf_ip6_rcv sets IP6SKB_L3SLAVE but decap_and_validate fails to mirror it into IPSKB_L3SLAVE
  3. Kernel performs socket lookup without L3 master device context
  4. Packet is delivered to or accepted by a socket outside the VRF or dropped despite matching a VRF-bound socket

How to detect it

Review kernel logs for seg6 or VRF-related decapsulation events; correlate inbound SRv6 packets on enslaved interfaces with unexpected socket deliveries in non-VRF namespaces; inspect packet captures for End.DX4 segments followed by traffic reaching default-VRF sockets.

What your security team should do

  • Prioritize patching all systems running SRv6 with VRF interfaces within the published remediation window
  • Audit VRF configurations and socket binding practices to ensure they rely on the corrected L3 master semantics
  • Monitor kernel changelogs for backports to supported LTS branches

The record

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate() has never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the common case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of a reassembled outer packet could even set it, with no VRF involved. Commit 44930446dde4 ("ipv6: seg6: clear IPv4 control block on IPIP decapsulation") then made the unreliable bit reliably clear. The effect of the missing flag is visible with End.DX4 when a delivery to a local address of the node reaches the socket lookup. For example, a UDP socket bound to the enslaved ingress interface does not receive any of the decapsulated packets, while an unbound socket outside the VRF does. This contradicts Documentation/networking/vrf.rst: by default the scope of an unbound UDP or TCP socket is limited to the default VRF. Set IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does the same for IPv6. The socket lookup then matches the decapsulated packet like any other packet received on that enslaved interface. Such a packet matches an unbound UDP or TCP socket only when udp_l3mdev_accept or tcp_l3mdev_accept is set.

Affected packages

Ecosystem Package Introduced Fixed