Cloudanix VulnDB

CVE-2026-98383

None

CVSS

—

EPSS

0.2%

Published

Oct 9, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's networking code could let a skilled local attacker corrupt memory when certain advanced IPv6 routing features and custom programs are used together.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free via dangling per-CPU SRH pointer after bpf_skb_pull_data() reallocates skb->head in LWT_SEG6LOCAL programs that previously called bpf_lwt_seg6_adjust_srh().

Why it matters to the business

Kernel memory corruption on systems running affected Linux kernels with IPv6 segment routing and custom BPF programs, potentially causing crashes, denial of service, or local privilege escalation; low public exploitability reduces immediate widespread risk but still requires prompt patching.

How an attack unfolds

An attacker with ability to load BPF programs crafts an LWT_SEG6LOCAL program that calls bpf_lwt_seg6_adjust_srh() to invalidate the cached SRH, followed by bpf_skb_pull_data() to trigger skb head reallocation, then relies on post-program SRH validation to write through the now-dangling pointer.

How to fix it

Upgrade to a Linux kernel containing the fix that disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs; rebuild and redeploy any custom segment-routing BPF programs after the update.

How to confirm the fix worked

Confirm the kernel version includes the verifier change that rejects the unsafe helper combination for LWT_SEG6LOCAL; test by attempting to load a BPF program containing both bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data() and verifying it is rejected.

Typical attack path

  1. Obtain CAP_BPF or equivalent privileges to load a custom BPF program
  2. Attach the program to an LWT_SEG6LOCAL hook
  3. Invoke bpf_lwt_seg6_adjust_srh() to invalidate cached SRH
  4. Call bpf_skb_pull_data() to force skb reallocation
  5. Trigger post-program SRH validation to perform the out-of-bounds write

How to detect it

Review kernel logs for oops or panic messages referencing skb, SRH, or seg6; inspect audit logs for unexpected BPF program loads attached to LWT hooks; search system call traces for bpf() invocations targeting seg6local.

What your security team should do

  • Prioritize kernel updates on any hosts using IPv6 segment routing with custom BPF programs
  • Audit existing LWT_SEG6LOCAL BPF programs for use of bpf_skb_pull_data()
  • Monitor EPSS and KEV status for any future increase in exploit activity
  • Restrict unprivileged BPF loading via sysctl until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer. Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwt_out_func_proto().

Affected packages

Ecosystem Package Introduced Fixed