Skip to content
Heist/ feed
Unrated

seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate() has never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the common case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of a reassembled outer packet could even set it, with no VRF involved. Commit 44930446dde4 ("ipv6: seg6: clear IPv4 control block on IPIP decapsulation") then made the unreliable bit reliably clear. The effect of the missing flag is visible with End.DX4 when a delivery to a local address of the node reaches the socket lookup. For example, a UDP socket bound to the enslaved ingress interface does not receive any of the decapsulated packets, while an unbound socket outside the VRF does. This contradicts Documentation/networking/vrf.rst: by default the scope of an unbound UDP or TCP socket is limited to the default VRF. Set IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does the same for IPv6. The socket lookup then matches the decapsulated packet like any other packet received on that enslaved interface. Such a packet matches an unbound UDP or TCP socket only when udp_l3mdev_accept or tcp_l3mdev_accept is set.

Announced Source revision 1
Original source ↗

CVE-2026-98306

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-98306

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "1d9f5c78903dd25a3556229eb716dd465c5f3573",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "72f410616000d21a0a6ec6c93a60301b9c92e95c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "e4d7c52f15f572608374947c6c802052e1a2fc82",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "5130afa025c95faa621adf8bac525baeb2b290d2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "f8fb4738ccef5f9d107845b05734a56352747b1a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "ddf60220c925b54a1714c4722fdbdb12833232d0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
        "lessThan": "7616242a2b37883f7322aaa1d2bd6cd0fed28315",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/ipv6/seg6_local.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.14"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.14",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.271",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.222",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.112",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.54",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.8",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv6/seg6_local.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-98306

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#38382 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement