Cloudanix VulnDB

CVE-2026-98531

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel checks the size of certain network configuration messages can let an attacker read a small amount of random internal memory and send it back out.

Chainable
Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read of 16 bytes from uninitialized kernel memory when processing a short SEG6_ATTR_DST attribute in seg6_genl_set_tunsrc, with the leaked data stored in tun_src and returned to userspace.

Why it matters to the business

Low-probability information disclosure from kernel memory that could aid attackers in reconnaissance or exploit development; recent disclosure with no observed exploitation increases patch urgency for exposed systems.

How an attack unfolds

An attacker crafts a SEG6_CMD_SET_TUNSRC Generic Netlink message containing a zero-length SEG6_ATTR_DST attribute, bypassing length validation; the kernel copies 16 bytes beyond the attribute into tun_src, which is later leaked via SEG6_CMD_GET_TUNSRC.

How to fix it

Apply the upstream kernel patch that replaces NLA_BINARY with NLA_POLICY_EXACT_LEN for SEG6_ATTR_DST; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm netlink policy validation returns -ERANGE for non-exact-length SEG6_ATTR_DST attributes and that SEG6_CMD_GET_TUNSRC returns zeroed tun_src after a rejected SET operation.

Typical attack path

  1. Send SEG6_CMD_SET_TUNSRC netlink message with undersized SEG6_ATTR_DST
  2. Kernel performs kmemdup of fixed 16-byte size past the attribute boundary
  3. Follow with SEG6_CMD_GET_TUNSRC to retrieve the leaked kernel memory

How to detect it

Inspect audit logs or netlink traces for SEG6_CMD_SET_TUNSRC messages carrying zero-length SEG6_ATTR_DST attributes followed immediately by SEG6_CMD_GET_TUNSRC; correlate with processes holding CAP_NET_ADMIN.

What your security team should do

  • Prioritize kernel updates on any system exposing IPv6 segment routing netlink interfaces
  • Monitor for new stable releases containing the exact_len policy change
  • Review network-facing configurations that permit unprivileged netlink access to seg6 commands

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tun_src and leaked back to userspace via SEG6_CMD_GET_TUNSRC. Switch SEG6_ATTR_DST in seg6_genl_policy to NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6_addr) with -ERANGE. Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of uninitialized kernel heap memory (tun_src = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tun_src remains zeroed.

Affected packages

Ecosystem Package Introduced Fixed