CVE-2026-98802 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
seg6: ensure packet data is writable before modifying SRH and IPv6 DA
advance_nextseg() modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6_next_csid_advance_arg() has the same problem when it advances the NEXT-C-SID argument in the destination address.
The skb may be cloned, for example by an AF_PACKET socket receiving on the ingress device. advance_nextseg() and seg6_next_csid_advance_arg() then write into the packet data shared with the clone. A read from that socket can return the modified packet instead of the received one. The simplified path below shows this for advance_nextseg():
__netif_receive_skb_one_core __netif_receive_skb_core deliver_skb [orig: users=2, cloned=0]
packet_rcv skb_clone clone queued to the AF_PACKET socket consume_skb(orig) [orig: users=1, cloned=1]
ipv6_rcv ip6_rcv_core skb_share_check: no-op [orig: users=1]
[...]
input_action_end_core advance_nextseg writes into the data shared with the clone
Call skb_ensure_writable() in advance_nextseg() and in seg6_next_csid_advance_arg() before they modify the packet data. skb_ensure_writable() may reallocate skb->head, which invalidates the pointers into the packet data taken before the call. advance_nextseg() now returns a valid SRH pointer, or NULL if skb_ensure_writable() fails. seg6_next_csid_advance_arg() takes the pointer to the destination address from the skb after skb_ensure_writable(). On failure, the callers drop the packet with SKB_DROP_REASON_NOMEM.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a critical memory safety vulnerability within the Segment Routing over IPv6 (SRv6) implementation, specifically affecting the seg6 subsystem. This flaw arises from improper handling of network buffer structures during packet processing, where modifications to segment routing headers and destination addresses are performed without first verifying that the underlying data buffers are writable. The core issue resides in two primary functions: advance_nextseg() and seg6_next_csid_advance_arg(). These routines are responsible for advancing the state of SRv6 packets by modifying the Segments Left field within the Segment Routing Header and updating the IPv6 destination address respectively. However, prior to these modifications, neither function checks whether the socket buffer contains a unique copy of the packet data or if it is shared with other entities through cloning mechanisms. This oversight creates a scenario where concurrent writes can corrupt memory that is being read by other processes, leading to undefined behavior and potential system instability.
The operational impact of this vulnerability is significant due to how network interfaces handle incoming traffic. When an AF_PACKET socket receives packets on the ingress device, it often triggers a cloning operation for the socket buffer structure. In such scenarios, the original packet data pointer may be shared between the kernel's internal processing path and the user-space application reading from the socket. If advance_nextseg() or seg6_next_csid_advance_arg() proceeds to modify this shared memory region without ensuring exclusivity via skb_ensure_writable(), the modifications will inadvertently alter the data visible to the AF_PACKET socket reader. Consequently, a process monitoring network traffic may receive corrupted packet contents that reflect internal kernel state changes rather than the actual received payload. This constitutes an information leak and violates the integrity of captured network data, potentially exposing sensitive application-layer protocols or authentication tokens embedded within the packets if they are processed through this vulnerable path.
From a technical perspective, the vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input in C/C++, although it specifically manifests as a lack of write-access verification leading to shared memory corruption. In terms of attack vectors and tactical classification within the MITRE ATT&CK framework for Linux systems, this flaw aligns with techniques related to privilege escalation or defense evasion if exploited by local users to manipulate packet processing logic, though its primary manifestation is data integrity compromise. The root cause lies in the assumption that socket buffers are always exclusive when passed through certain network stack paths. While many kernel functions correctly call skb_share_check() or similar mechanisms before modification, these specific SRv6 handling routines failed to enforce this requirement. This gap allows a local user with access to AF_PACKET sockets to trigger the code path and observe the side effects of concurrent memory writes, effectively bypassing standard isolation boundaries between network stack processing and user-space observation tools.
To mitigate this vulnerability, the Linux kernel developers have implemented a fix that mandates calling skb_ensure_writable() before any modification to packet data in both affected functions. This function ensures that if the socket buffer is shared or cloned, it will be duplicated so that subsequent writes occur on private memory rather than shared structures. The implementation also addresses pointer invalidation issues; since skb_ensure_writable() may reallocate the head of the socket buffer, any pointers obtained prior to this call become stale and dangerous to use. Therefore, advance_nextseg() has been updated to return a valid Segment Routing Header pointer only after successfully ensuring writability, or NULL if memory allocation fails. Similarly, seg6_next_csid_advance_arg() now retrieves the destination address pointer from the socket buffer structure immediately following the writability check. In cases where skb_ensure_writable() fails due to resource constraints, the callers are instructed to drop the packet with a specific error reason indicating insufficient memory, thereby preventing partial or corrupted processing of malformed packets. This patch restores data integrity guarantees and ensures that network monitoring tools receive accurate representations of traffic without interference from kernel-side state modifications.