Skip to content
Heist/ feed
Unrated

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tun_src and leaked back to userspace via SEG6_CMD_GET_TUNSRC. Switch SEG6_ATTR_DST in seg6_genl_policy to NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6_addr) with -ERANGE. Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of uninitialized kernel heap memory (tun_src = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tun_src remains zeroed.

Announced Source revision 1
Original source ↗

CVE-2026-98531

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-98531

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "050a0aa3c80907b8c60a396b7e04d48d8b1a9e70",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "209eefebee54c4a5f01d68b61e8ac9881eca2de9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "e3ac68c1cdc2535d127b2bfd50c263d16c8e4199",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "66bf65fa109326e4c4ddeb0b94093379f72838fd",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "195813bb7324c338eaba0aaa02b18681ee65b670",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "6fcfc362344edea745a69f3a705de50b731f3418",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "915d7e5e5930b4f01d0971d93b9b25ed17d221aa",
        "lessThan": "2d959c75c27f90e9ec489d18ce5ee6b852ad4741",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/ipv6/seg6.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.10"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.10",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.271",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.222",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.112",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.55",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.9",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv6/seg6.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-98531

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#38556 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement