From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97FE44D37C5 for ; Sun, 18 Oct 2026 16:25:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792340723; cv=none; b=uFugWaahQkEHp/2O429rxTU0nvssSaPXejkhGaatMFuv6aT2q9XBAPeGR/KKw7gD2qH+ABBd1RBhTuPZNiWWOYI673WgEJ5tyamWuKQj9AW/lIZq0Jp7D26mTEajyGt2MP5m5ZG9XKi/kdNuHEQKBGedyjwAV8rH/wuV71OWLHA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792340723; c=relaxed/simple; bh=0N6xds96u+HYT8oTUpj75ygqHJiqIgcdLN75MWVCH84=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Mqn/XdZuLgoo7Kmg88zkjlxMv9iqsYSQTdJZcFyPmK4Mcs5vZfbPNXzjwhwwmKWCYxAcbu5iMFJ3a97UU+9SZzPvoWju92LGBoN0/opSKfqL01NWow3jnW5HRtj1wP2tUXAhDgH2kQ26Ku3vnlX3bBaBEKjoqjcfT67yR5FrS2g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=suVhfGGn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="suVhfGGn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 876E61F000C4; Sun, 18 Oct 2026 16:25:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792340722; bh=9K9cznWGGYHAC/EMhblpVGEiw2zbgG/dDqmjvo06UnU=; h=From:To:Cc:Subject:Date:Reply-To; b=suVhfGGnyiph/4NWoAEFPujHKeqAS2+a47VAF6wmYX8jUtnJTUHZWCaLA4bjm1Wvz I3N9hZuvzmnlMlFB1uSLM2HbYwUE7+d/pFEsp+EunFyiAk0ainzQyP72XYoqnrvFHC Al/em+bPCPJ0Cyhwiow4wo4p2ZHc1FGJuSvd5GNE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98802: seg6: ensure packet data is writable before modifying SRH and IPv6 DA Date: Sun, 18 Oct 2026 17:46:17 +0200 Message-ID: <2026101825-CVE-2026-98802-dbf7@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3365; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=gJS7xrSgsjokVZBe7UiO5PHoAw8L5vWAvtJV2okzRXU=; b=kA0DAAIRMUfUDdst+ykByyZiAGrU6VnIWZdSBI8wfWq1TWlAiDGDJ+quvNlFiUE/ILAPESnf2 YhdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmrU6VkACgkQMUfUDdst+ym6VgCdFDbp fXZv5fn9TWcoKA1N/QCWV70AoKcVNor55tCjgZ4liHKLvHBHdWP2 X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advance_nextseg() modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6_next_csid_advance_arg() has the same problem when it advances the NEXT-C-SID argument in the destination address. The skb may be cloned, for example by an AF_PACKET socket receiving on the ingress device. advance_nextseg() and seg6_next_csid_advance_arg() then write into the packet data shared with the clone. A read from that socket can return the modified packet instead of the received one. The simplified path below shows this for advance_nextseg(): __netif_receive_skb_one_core __netif_receive_skb_core deliver_skb [orig: users=2, cloned=0] packet_rcv skb_clone clone queued to the AF_PACKET socket consume_skb(orig) [orig: users=1, cloned=1] ipv6_rcv ip6_rcv_core skb_share_check: no-op [orig: users=1] [...] input_action_end_core advance_nextseg writes into the data shared with the clone Call skb_ensure_writable() in advance_nextseg() and in seg6_next_csid_advance_arg() before they modify the packet data. skb_ensure_writable() may reallocate skb->head, which invalidates the pointers into the packet data taken before the call. advance_nextseg() now returns a valid SRH pointer, or NULL if skb_ensure_writable() fails. seg6_next_csid_advance_arg() takes the pointer to the destination address from the skb after skb_ensure_writable(). On failure, the callers drop the packet with SKB_DROP_REASON_NOMEM. The Linux kernel CVE team has assigned CVE-2026-98802 to this issue. Affected and fixed versions =========================== Issue introduced in 4.14 with commit 140f04c33bbcf89440dcaf8bef04918abff5a52d and fixed in 7.2.10 with commit e9141fdb7a2ead48cfcd60c681aba91d3014255b Issue introduced in 4.14 with commit 140f04c33bbcf89440dcaf8bef04918abff5a52d and fixed in 7.3-rc6 with commit 8ae3f4067ba4ae3a15581392f6dac422e3d3def0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98802 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv6/seg6_local.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e9141fdb7a2ead48cfcd60c681aba91d3014255b https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0