CVE-2026-72400

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72400", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.925Z", "datePublished": "2026-08-15T05:56:25.572Z", "dateUpdated": "2026-10-16T18:55:21.670Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:42.988Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: validate SRH length before reading fixed fields\n\nseg6_validate_srh() reads fixed SRH fields such as srh->type and\nsrh->hdrlen before checking that the supplied length covers the fixed\nstruct ipv6_sr_hdr fields.\n\nThe BPF SEG6 encap path reaches this with a BPF program-supplied pointer\nand length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and\nEND_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the\nlength to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6\nencap header can therefore make the validator read srh->type at offset 2\nbeyond the caller-supplied buffer.\n\nReject lengths shorter than the fixed SRH at the top of\nseg6_validate_srh(), before any field is read. This fixes the BPF helper\npath and keeps the common validator robust."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires loading BPF LWT SEG6 programs and attaching SRv6 routes via bpf() and RTNETLINK; the OOB read is triggered through bpf_lwt_push_encap/bpf_lwt_seg6_action helpers, not by remote IPv6 packet parsing alone.\nAC:L - An attacker with route/BPF setup privileges can deterministically call bpf_push_seg6_encap() or bpf_lwt_seg6_action(END_B6/END_B6_ENCAP) with a 2-byte buffer, immediately forcing seg6_validate_srh() to read fixed SRH fields past the buffer end.\nPR:L - Loading BPF_PROG_TYPE_LWT_IN/LWT_SEG6LOCAL and installing SRv6 LWT routes requires CAP_NET_ADMIN, obtainable by unprivileged users inside user/network namespaces (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is required; triggering the bug needs only attacker-controlled BPF execution during SRv6/LWT packet processing after the attacker configures routes and programs.\nS:U - Impact is confined to kernel memory safety within the same host security boundary; there is no VM escape, sandbox breakout, or cross-authority scope change beyond standard local kernel compromise.\nC:H - seg6_validate_srh() performs out-of-bounds reads of SRH header bytes (e.g., srh->type at offset 2) beyond the attacker-supplied length, disclosing adjacent kernel/BPF stack memory that may include pointers and sensitive metadata.\nI:H - Kernel out-of-bounds reads in this validation path constitute memory-safety corruption that can be chained with disclosed pointers and heap/stack layout control from BPF context to obtain arbitrary write or code-execution primitives.\nA:H - Undersized SRH buffers can cause seg6_validate_srh() to read past mapped BPF/kernel memory and trigger kernel faults, oops, or panic on SRv6 routers processing attacker-driven BPF SEG6 encap traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/seg6.c"], "versions": [{"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "715eb12e453df752f1b4baaf972c3acff0ab9402", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "804bb969f194c93497ba632b98343794c6367fdc", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "0fc7069d39239978130c37ebceaec85c8948d3f1", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "8dba7a94a269b88e500aafc25ad567ef6a423698", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "c9961336aa5ff83092f23e33ee86666a9dbd1b2a", "status": "affected", "versionType": "git"}, {"version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/seg6.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/715eb12e453df752f1b4baaf972c3acff0ab9402"}, {"url": "https://git.kernel.org/stable/c/7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73"}, {"url": "https://git.kernel.org/stable/c/071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e"}, {"url": "https://git.kernel.org/stable/c/804bb969f194c93497ba632b98343794c6367fdc"}, {"url": "https://git.kernel.org/stable/c/0fc7069d39239978130c37ebceaec85c8948d3f1"}, {"url": "https://git.kernel.org/stable/c/8dba7a94a269b88e500aafc25ad567ef6a423698"}, {"url": "https://git.kernel.org/stable/c/c9961336aa5ff83092f23e33ee86666a9dbd1b2a"}, {"url": "https://git.kernel.org/stable/c/a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa"}], "title": "seg6: validate SRH length before reading fixed fields", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:48:57.930959Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:21.670Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72400", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:48:57.930959Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:48:58.855Z"}}], "cna": {"title": "seg6: validate SRH length before reading fixed fields", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires loading BPF LWT SEG6 programs and attaching SRv6 routes via bpf() and RTNETLINK; the OOB read is triggered through bpf_lwt_push_encap/bpf_lwt_seg6_action helpers, not by remote IPv6 packet parsing alone.\nAC:L - An attacker with route/BPF setup privileges can deterministically call bpf_push_seg6_encap() or bpf_lwt_seg6_action(END_B6/END_B6_ENCAP) with a 2-byte buffer, immediately forcing seg6_validate_srh() to read fixed SRH fields past the buffer end.\nPR:L - Loading BPF_PROG_TYPE_LWT_IN/LWT_SEG6LOCAL and installing SRv6 LWT routes requires CAP_NET_ADMIN, obtainable by unprivileged users inside user/network namespaces (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is required; triggering the bug needs only attacker-controlled BPF execution during SRv6/LWT packet processing after the attacker configures routes and programs.\nS:U - Impact is confined to kernel memory safety within the same host security boundary; there is no VM escape, sandbox breakout, or cross-authority scope change beyond standard local kernel compromise.\nC:H - seg6_validate_srh() performs out-of-bounds reads of SRH header bytes (e.g., srh->type at offset 2) beyond the attacker-supplied length, disclosing adjacent kernel/BPF stack memory that may include pointers and sensitive metadata.\nI:H - Kernel out-of-bounds reads in this validation path constitute memory-safety corruption that can be chained with disclosed pointers and heap/stack layout control from BPF context to obtain arbitrary write or code-execution primitives.\nA:H - Undersized SRH buffers can cause seg6_validate_srh() to read past mapped BPF/kernel memory and trigger kernel faults, oops, or panic on SRv6 routers processing attacker-driven BPF SEG6 encap traffic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "715eb12e453df752f1b4baaf972c3acff0ab9402", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "804bb969f194c93497ba632b98343794c6367fdc", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "0fc7069d39239978130c37ebceaec85c8948d3f1", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "8dba7a94a269b88e500aafc25ad567ef6a423698", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "c9961336aa5ff83092f23e33ee86666a9dbd1b2a", "versionType": "git"}, {"status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "lessThan": "a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa", "versionType": "git"}], "programFiles": ["net/ipv6/seg6.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"status": "unaffected", "version": "0", "lessThan": "4.18", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/seg6.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/715eb12e453df752f1b4baaf972c3acff0ab9402"}, {"url": "https://git.kernel.org/stable/c/7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73"}, {"url": "https://git.kernel.org/stable/c/071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e"}, {"url": "https://git.kernel.org/stable/c/804bb969f194c93497ba632b98343794c6367fdc"}, {"url": "https://git.kernel.org/stable/c/0fc7069d39239978130c37ebceaec85c8948d3f1"}, {"url": "https://git.kernel.org/stable/c/8dba7a94a269b88e500aafc25ad567ef6a423698"}, {"url": "https://git.kernel.org/stable/c/c9961336aa5ff83092f23e33ee86666a9dbd1b2a"}, {"url": "https://git.kernel.org/stable/c/a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: validate SRH length before reading fixed fields\n\nseg6_validate_srh() reads fixed SRH fields such as srh->type and\nsrh->hdrlen before checking that the supplied length covers the fixed\nstruct ipv6_sr_hdr fields.\n\nThe BPF SEG6 encap path reaches this with a BPF program-supplied pointer\nand length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and\nEND_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the\nlength to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6\nencap header can therefore make the validator read srh->type at offset 2\nbeyond the caller-supplied buffer.\n\nReject lengths shorter than the fixed SRH at the top of\nseg6_validate_srh(), before any field is read. This fixes the BPF helper\npath and keeps the common validator robust."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "4.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:42.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72400", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:21.670Z", "dateReserved": "2026-08-09T03:40:39.925Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:56:25.572Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/seg6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "715eb12e453df752f1b4baaf972c3acff0ab9402", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "804bb969f194c93497ba632b98343794c6367fdc", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "0fc7069d39239978130c37ebceaec85c8948d3f1", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "8dba7a94a269b88e500aafc25ad567ef6a423698", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "c9961336aa5ff83092f23e33ee86666a9dbd1b2a", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}, {"lessThan": "a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa", "status": "affected", "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/seg6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: validate SRH length before reading fixed fields\n\nseg6_validate_srh() reads fixed SRH fields such as srh->type and\nsrh->hdrlen before checking that the supplied length covers the fixed\nstruct ipv6_sr_hdr fields.\n\nThe BPF SEG6 encap path reaches this with a BPF program-supplied pointer\nand length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and\nEND_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the\nlength to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6\nencap header can therefore make the validator read srh->type at offset 2\nbeyond the caller-supplied buffer.\n\nReject lengths shorter than the fixed SRH at the top of\nseg6_validate_srh(), before any field is read. This fixes the BPF helper\npath and keeps the common validator robust."}], "id": "CVE-2026-72400", "lastModified": "2026-10-16T19:17:27.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72400", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:48:57.930959Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:13.567", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0fc7069d39239978130c37ebceaec85c8948d3f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/715eb12e453df752f1b4baaf972c3acff0ab9402"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/804bb969f194c93497ba632b98343794c6367fdc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8dba7a94a269b88e500aafc25ad567ef6a423698"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c9961336aa5ff83092f23e33ee86666a9dbd1b2a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: seg6: validate SRH length before reading fixed fields", "id": "2516698", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516698"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nseg6: validate SRH length before reading fixed fields\nseg6_validate_srh() reads fixed SRH fields such as srh->type and\nsrh->hdrlen before checking that the supplied length covers the fixed\nstruct ipv6_sr_hdr fields.\nThe BPF SEG6 encap path reaches this with a BPF program-supplied pointer\nand length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and\nEND_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the\nlength to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6\nencap header can therefore make the validator read srh->type at offset 2\nbeyond the caller-supplied buffer.\nReject lengths shorter than the fixed SRH at the top of\nseg6_validate_srh(), before any field is read. This fixes the BPF helper\npath and keeps the common validator robust.", "A flaw was found in the Linux kernel's Segment Routing over IPv6 (SEG6) component. Insufficient validation of the Segment Routing Header (SRH) length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF (Berkeley Packet Filter) program, could provide a short SEG6 encapsulation header, causing the system to read beyond the allocated buffer. This could result in information disclosure or potentially a denial of service."], "name": "CVE-2026-72400", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72400\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72400\nhttps://lore.kernel.org/linux-cve-announce/2026081521-CVE-2026-72400-c4b1@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,715eb12e453df752f1b4baaf972c3acff0ab9402)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,804bb969f194c93497ba632b98343794c6367fdc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,0fc7069d39239978130c37ebceaec85c8948d3f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,8dba7a94a269b88e500aafc25ad567ef6a423698)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,c9961336aa5ff83092f23e33ee86666a9dbd1b2a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe94cc290f535709d3c5ebd1e472dfd0aec7ee79,a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.18,*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:15:03.782187+00:00", "updated": "2026-08-22T07:00:07.547364+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}