CVE-2026-98934 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") a caller provided pointer.
syzbot was able to reach seg6_make_flowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6_flowlabel is set to 1.
seg6_make_flowlabel() already has a net pointer, use skb_get_hash_net().
WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930 Call trace: __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P) __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903 skb_get_hash include/linux/skbuff.h:1663 [inline]
seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132 __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161 seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431 seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681 seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744 lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356 dst_output include/net/dst.h:470 [inline]
ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131 iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97 udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187 tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202 tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274 tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576 tipc_enable_bearer net/tipc/bearer.c:366 [inline]
__tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048 tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel vulnerability addressed in this update involves a critical flaw within the IPv6 Segment Routing implementation, specifically in the seg6_make_flowlabel function. This issue stems from an incompatibility between network namespace requirements and packet buffer handling during encapsulation processes. The root cause lies in the evolution of the flow dissector subsystem, where recent commits introduced mandatory net pointer dependencies for __skb_flow_dissect operations. When a socket buffer lacks both device and socket context pointers, the kernel previously attempted to derive necessary networking information through insufficient means, leading to potential null pointer dereferences or undefined behavior during hash calculation routines essential for flow labeling in Segment Routing over IPv6 configurations.
From an operational perspective, this vulnerability manifests when specific network conditions align: a TIPC UDP bearer sends discovery messages routed via IPv4 while utilizing seg6 encapsulation with the net.ipv6.seg6_flowlabel parameter enabled. Under these circumstances, syzbot identified that packets arrive at seg6_make_flowlabel without required skb->dev or skb->sk attributes populated. This absence prevents proper network namespace resolution during flow label generation, potentially causing kernel warnings and system instability. The attack surface includes scenarios where automated testing tools like syzkuzzer can trigger this code path through carefully crafted netlink messages that enable TIPC bearers under constrained routing conditions.
The technical flaw centers on improper hash computation methodology when dealing with incomplete socket buffer contexts. Previously, the function relied on indirect methods to obtain network namespace information necessary for generating consistent flow labels required by Segment Routing protocols. With modern kernel developments requiring explicit net pointer provisionality in __skb_flow_dissect calls, the absence of direct context led to unsafe memory access patterns or failed assertions within critical networking subsystems. The fix implements skb_get_hash_net() which properly handles cases where traditional socket buffer metadata is unavailable by accepting an explicit network namespace parameter instead of attempting implicit derivation through potentially null pointers.
This vulnerability maps directly to CWE-476, representing a NULL pointer dereference scenario that could lead to denial of service conditions in production environments. From the MITRE ATT&CK framework perspective, this aligns with T1059 Command and Scripting Interpreter techniques where attackers might exploit kernel-level vulnerabilities through crafted network packets or administrative interface interactions via netlink protocols. The vulnerability demonstrates how complex interdependencies between networking subsystems can create unexpected failure modes when assumptions about packet buffer state are violated during encapsulation operations.
Mitigation strategies involve applying the provided kernel patch that updates seg6_make_flowlabel to utilize skb_get_hash_net() with explicit network namespace parameters. System administrators should ensure their Linux kernels include this specific fix, particularly those deploying TIPC over UDP configurations combined with IPv6 Segment Routing features. Regular security audits focusing on networking subsystem integrity checks and monitoring for unusual kernel warning messages related to flow dissector operations can help detect potential exploitation attempts before they cause significant system disruptions.