Cloudanix VulnDB

CVE-2026-98934

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A rare Linux kernel networking bug can produce scary error messages or instability when specific IPv6 and TIPC features are used together.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Kernel path in seg6_make_flowlabel() calls __skb_flow_dissect without a net pointer when skb->dev and skb->sk are absent, triggering a WARNING in net/core/flow_dissector.c under net.ipv6.seg6_flowlabel=1.

Why it matters to the business

Rare but possible kernel warning or instability on systems using IPv6 segment routing together with TIPC UDP bearers, increasing operational noise and potential availability impact in specialized networking environments.

How an attack unfolds

An attacker configures or triggers TIPC UDP bearer discovery messages that traverse an IPv4 route with seg6 encapsulation while the seg6_flowlabel sysctl is enabled; the resulting skb lacks dev/sk pointers, causing the flow dissector to warn when attempting hash calculation.

How to fix it

Update to a Linux kernel containing the fix that replaces skb_get_hash with skb_get_hash_net in seg6_make_flowlabel; apply the patch from commit referenced in the description if backporting is required.

How to confirm the fix worked

Confirm the presence of skb_get_hash_net() call in net/ipv6/seg6_iptunnel.c:seg6_make_flowlabel and verify that the WARNING no longer triggers under the original syzbot reproducer conditions.

Typical attack path

  1. Enable net.ipv6.seg6_flowlabel=1 on target
  2. Send crafted TIPC discovery messages via UDP bearer using IPv4 route with seg6 encap
  3. Trigger seg6_output path that reaches seg6_make_flowlabel without skb dev/sk
  4. Observe kernel WARNING in flow_dissector

How to detect it

Search kernel logs for the exact WARNING string from net/core/flow_dissector.c mentioning __skb_flow_dissect and seg6_make_flowlabel; correlate with TIPC UDP bearer activity.

  • WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect
  • seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132
  • tipc_udp_xmit

What your security team should do

  • Prioritize kernel updates on any systems with IPv6 SR and TIPC UDP in use
  • Monitor for the flow_dissector WARNING in production kernels
  • Disable seg6_flowlabel if the feature is unused

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") a caller provided pointer. syzbot was able to reach seg6_make_flowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6_flowlabel is set to 1. seg6_make_flowlabel() already has a net pointer, use skb_get_hash_net(). WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930 Call trace: __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P) __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903 skb_get_hash include/linux/skbuff.h:1663 [inline] seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132 __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161 seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431 seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681 seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744 lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356 dst_output include/net/dst.h:470 [inline] ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131 iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97 udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187 tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202 tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274 tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576 tipc_enable_bearer net/tipc/bearer.c:366 [inline] __tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048 tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114

Affected packages

Ecosystem Package Introduced Fixed