Cloudanix VulnDB

CVE-2026-98802

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network code can let certain monitoring tools see altered network packets instead of the real ones they received.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to call skb_ensure_writable before mutating SRH Segments Left and IPv6 destination address fields allows writes into a cloned skb shared with an AF_PACKET listener, causing the clone to receive altered packet contents instead of the original.

Why it matters to the business

Network monitoring, capture, or forwarding processes may observe or forward corrupted IPv6 Segment Routing packets, leading to incorrect telemetry, dropped legitimate traffic, or silent data integrity issues in high-volume SRv6 environments.

How an attack unfolds

An attacker sends IPv6 packets containing an SRH that triggers advance_nextseg or seg6_next_csid_advance_arg on a system also running an AF_PACKET socket on the ingress interface; the skb is cloned for the socket, the mutation occurs on the shared data, and the socket reader receives the modified packet.

How to fix it

Update the Linux kernel to a version containing the skb_ensure_writable calls in advance_nextseg and seg6_next_csid_advance_arg; rebuild and reboot systems that process SRv6 traffic.

How to confirm the fix worked

Confirm the presence of the skb_ensure_writable guard and updated return-value handling in the seg6 code paths; recompile with CONFIG_IPV6_SEG6=y and exercise SRH processing under packet capture load to verify no shared-data mutations occur.

Typical attack path

  1. Send crafted IPv6 SRH packet toward target interface
  2. AF_PACKET socket on ingress device triggers skb_clone
  3. ip6_rcv_core / input_action_end_core path reaches advance_nextseg without ensuring writability
  4. Mutation writes into the clone's shared data region
  5. AF_PACKET reader receives altered packet instead of original

How to detect it

Review kernel packet capture logs and skb-related tracepoints for unexpected modifications to SRH fields after clone operations; correlate AF_PACKET socket activity with IPv6 Segment Routing traffic.

What your security team should do

  • Prioritize kernel upgrades on all SRv6-capable routers and hosts within the next maintenance window
  • Monitor upstream stable branches for the exact commit that adds the writable checks
  • Temporarily restrict AF_PACKET privileges on production SRv6 nodes if immediate patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advance_nextseg() modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6_next_csid_advance_arg() has the same problem when it advances the NEXT-C-SID argument in the destination address. The skb may be cloned, for example by an AF_PACKET socket receiving on the ingress device. advance_nextseg() and seg6_next_csid_advance_arg() then write into the packet data shared with the clone. A read from that socket can return the modified packet instead of the received one. The simplified path below shows this for advance_nextseg(): __netif_receive_skb_one_core __netif_receive_skb_core deliver_skb [orig: users=2, cloned=0] packet_rcv skb_clone clone queued to the AF_PACKET socket consume_skb(orig) [orig: users=1, cloned=1] ipv6_rcv ip6_rcv_core skb_share_check: no-op [orig: users=1] [...] input_action_end_core advance_nextseg writes into the data shared with the clone Call skb_ensure_writable() in advance_nextseg() and in seg6_next_csid_advance_arg() before they modify the packet data. skb_ensure_writable() may reallocate skb->head, which invalidates the pointers into the packet data taken before the call. advance_nextseg() now returns a valid SRH pointer, or NULL if skb_ensure_writable() fails. seg6_next_csid_advance_arg() takes the pointer to the destination address from the skb after skb_ensure_writable(). On failure, the callers drop the packet with SKB_DROP_REASON_NOMEM.

Affected packages

Ecosystem Package Introduced Fixed