CVE-2026-98531

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and

.len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the

maximum payload length and permits shorter payloads (e.g., 0 bytes).

When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via

kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute

triggers a 16-byte out-of-bounds read past skb->tail into uninitialized

skb->head memory, which is stored in sdata->tun_src and leaked back to

userspace via SEG6_CMD_GET_TUNSRC.

Switch SEG6_ATTR_DST in seg6_genl_policy to

NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink

validation rejects any attribute whose length is not exactly

sizeof(struct in6_addr) with -ERANGE.

Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC

Generic Netlink message with a 0-byte SEG6_ATTR_DST

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References