CVE-2026-98383

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98383", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.345Z", "datePublished": "2026-10-09T07:34:22.408Z", "dateUpdated": "2026-10-24T14:08:40.964Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:40.964Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The local bpf(BPF_PROG_LOAD) path reaches check_helper_call() and the patched lwt_seg6local_func_proto(), where attacker-authored bytecode requests bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data(); an RTM_NEWROUTE then attaches it. A received SRH packet merely executes that installed program and cannot create the unsafe helper sequence.\nAC:L - The attacker controls the helper order, SRH offset and length, and can inject a large non-linear SRv6 frame so bpf_skb_pull_data() deterministically reaches __pskb_pull_tail() and pskb_expand_head(). No race is required, and repeated packets reproduce the stale-pointer write.\nPR:L - bpf_prog_load() requires CAP_BPF and CAP_NET_ADMIN for BPF_PROG_TYPE_LWT_SEG6LOCAL, but BPF_F_TOKEN_FD and bpf_token_capable() support delegating both into a user namespace; rtnetlink_rcv_msg() separately accepts CAP_NET_ADMIN in the route's network namespace. Thus a host-unprivileged token holder can perform the complete setup.\nUI:N - The attacker loads the program, installs the End.BPF route, and injects the triggering SRv6 frame without any victim action.\nS:U - The stale srh pointer and resulting corruption occur in the same host kernel that processes the attacker's BPF program and packet; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - After skb->head is freed, seg6_bpf_has_valid_srh() passes the dangling srh pointer to seg6_validate_srh(), which reads header fields and variable-length TLVs from reusable slab memory; its drop-versus-forward result also provides an observable contents oracle.\nI:H - seg6_bpf_has_valid_srh() executes srh->hdrlen = srh_state->hdrlen >> 3 through the dangling pointer, producing an attacker-valued one-byte write into freed slab memory that can corrupt a reclaimed object or allocator state and support control-flow compromise.\nA:H - The stale write in seg6_bpf_has_valid_srh() is a confirmed slab use-after-free and can trigger a KASAN panic or later kernel oops through corrupted freed-object state; the attacker can repeat it with additional packets."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "b9bb0e735460751b620156f800a4279a28573392", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1", "status": "affected", "versionType": "git"}, {"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32"}, {"url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f"}, {"url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb"}, {"url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf"}, {"url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392"}, {"url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5"}, {"url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1"}, {"url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"}], "title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "b9bb0e735460751b620156f800a4279a28573392", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}, {"lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5", "status": "affected", "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."}], "id": "CVE-2026-98383", "lastModified": "2026-10-24T14:16:40.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-09T08:16:56.800", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL", "id": "2548395", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548395"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto().", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local attacker with privileges to load BPF programs could exploit this vulnerability to cause a Denial of Service (DoS) or potentially corrupt system memory. The issue occurs when an IPv6 segment routing program modifies routing headers and subsequently triggers packet buffer reallocation, leaving an internal pointer referencing invalid memory. Subsequent validation routines write through this dangling pointer, resulting in memory corruption and a system crash."], "name": "CVE-2026-98383", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98383\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98383\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98383.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,0f38472a2aa8704a6b514c0dfa9c32f3672b8f32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,cae8674489f26edf7553fdd660599466cbb4c32f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,9f9e57b5a3a033f95f49ef9d541340cdbcb80abb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,df0072be6fc373cb22f9ea854d458b04e32a03cf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,b9bb0e735460751b620156f800a4279a28573392)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,37b18688cd18fd86d2f35c212df1611862a26cd5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,fca71ead7a20290af1e2046983eeafae43d21af1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[004d4b274e2a1a895a0e5dc66158b90a7d463d44,e4a62833adff6ef0fe7c0b90393204fe3c26b5c5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-09T09:30:03.360261+00:00", "updated": "2026-10-24T17:45:13.863699+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}