In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: restore network header before routing and forwarding
ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH)
while skb_network_header() points at the IPv6 header.
When segments_left > 0, ipv6_srh_rcv() previously restored the skb->data
position by pushing sizeof(struct ipv6hdr), assuming the SRH immediately
followed the fixed IPv6 header. If another extension header (such as a
Hop-by-Hop options header) precedes the SRH, skb_network_offset()
remained negative.
This led to two problems:
1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes
__skb_flow_dissect() which passes the negative skb_network_offset()
to flow dissection, breaking BPF and C flow dissector logic.
2. If forwarded via ip6_forward() or redirected via act_mirred, downstream
handlers (like sch_fragment() or neighbour output) pass the negative
offset as an unsigned length, triggering OOB memcpy or buffer overflows.
Fix this by pushing -skb_network_offset(skb) before routing, ensuring
skb_network_offset(skb) is 0 for route lookup / flow dissection as well as
downstream forwarding. On the loopback path, pull skb_transport_offset(skb)
to restore skb->data to the SRH before looping back.
References
Configurations
Configuration 1 (hide)
|
History
28 Oct 2026, 18:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/3ad7dca5e03bd64c65983a19734337512fd75491 - Patch | |
| References | () https://git.kernel.org/stable/c/8f44d4160bcdb3136a9145a4b9c7816382976925 - Patch | |
| References | () https://git.kernel.org/stable/c/975b5b067f525a1b1338c4a3bee1c46545801518 - Patch | |
| References | () https://git.kernel.org/stable/c/97b21ef57dfabbff660a4672c9fef7edfb720f47 - Patch | |
| References | () https://git.kernel.org/stable/c/9cfbe2c381ab6d00a08e7a5b6028865adfb4e1bc - Patch | |
| References | () https://git.kernel.org/stable/c/af08f62b5a5a446d6134a92d86771d3d12e0e3da - Patch | |
| References | () https://git.kernel.org/stable/c/ce4c8beedc19aceeab0e7bdc6f34394fb158c47c - Patch | |
| References | () https://git.kernel.org/stable/c/f463c4786cf27376de7dfc0833a12e924a98f698 - Patch | |
| CWE | CWE-787 | |
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
03 Oct 2026, 11:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Sep 2026, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
25 Sep 2026, 11:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-25 11:17
Updated : 2026-10-28 18:58
NVD link : CVE-2026-98096
Mitre link : CVE-2026-98096
CVE.ORG link : CVE-2026-98096
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write