Description
In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: restore network header before routing and forwarding

ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH)
while skb_network_header() points at the IPv6 header.

When segments_left > 0, ipv6_srh_rcv() previously restored the skb->data
position by pushing sizeof(struct ipv6hdr), assuming the SRH immediately
followed the fixed IPv6 header. If another extension header (such as a
Hop-by-Hop options header) precedes the SRH, skb_network_offset()
remained negative.

This led to two problems:
1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes
__skb_flow_dissect() which passes the negative skb_network_offset()
to flow dissection, breaking BPF and C flow dissector logic.
2. If forwarded via ip6_forward() or redirected via act_mirred, downstream
handlers (like sch_fragment() or neighbour output) pass the negative
offset as an unsigned length, triggering OOB memcpy or buffer overflows.

Fix this by pushing -skb_network_offset(skb) before routing, ensuring
skb_network_offset(skb) is 0 for route lookup / flow dissection as well as
downstream forwarding. On the loopback path, pull skb_transport_offset(skb)
to restore skb->data to the SRH before looping back.
Published: 2026-09-25
Score: 7.4 High
EPSS: n/a
KEV: No
Impact: Buffer overflow from negative skb_network_offset can lead to arbitrary code execution or denial of service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability occurs in the IPv6 Segment Routing (SR) handling code of the Linux kernel. When a Segment Routing Header is not the first extension header, the kernel misadjusts the skb data pointer, leaving skb_network_offset negative. This misalignment causes flow dissection and forwarding logic to use an incorrectly calculated offset, leading to out‑of‑bounds memory copies. The improper copy can corrupt memory, potentially enabling an attacker to execute arbitrary code or crash the system.

Affected Systems

All Linux kernel installations that support IPv6 Segment Routing and include the buggy ipv6_srh_rcv implementation. The issue is present in any kernel version prior to the commit that restores skb_network_offset. Both canonical Linux kernels from the mainline and downstream distributions that do not backport the fix are affected.

Risk and Exploitability

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw—an out‑of‑bounds write in kernel space—indicates a high severity risk. An attacker can craft a malicious IPv6 packet with a Segment Routing Header preceded by another extension header and send it to the kernel, triggering the offset bug. Although no public exploit is known, the high potential for arbitrary code execution makes the risk significant in any environment that processes such packets.

Generated by OpenCVE AI on September 25, 2026 at 16:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a release that includes the fix for the skb_network_offset issue (apply the commit that pushes -skb_network_offset before routing).
  • If an immediate kernel upgrade is not possible, block or drop IPv6 packets containing Segment Routing Headers, or reconfigure the system to disable Segment Routing support in the kernel and firewall rules.
  • Continuously monitor system logs for memory corruption, crashes, or abnormal BPF activity, and apply additional hardening such as SELinux or AppArmor profiles that limit kernel module execution.

Generated by OpenCVE AI on September 25, 2026 at 16:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-120
CWE-125

Fri, 25 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Fri, 25 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the skb->data position by pushing sizeof(struct ipv6hdr), assuming the SRH immediately followed the fixed IPv6 header. If another extension header (such as a Hop-by-Hop options header) precedes the SRH, skb_network_offset() remained negative. This led to two problems: 1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes __skb_flow_dissect() which passes the negative skb_network_offset() to flow dissection, breaking BPF and C flow dissector logic. 2. If forwarded via ip6_forward() or redirected via act_mirred, downstream handlers (like sch_fragment() or neighbour output) pass the negative offset as an unsigned length, triggering OOB memcpy or buffer overflows. Fix this by pushing -skb_network_offset(skb) before routing, ensuring skb_network_offset(skb) is 0 for route lookup / flow dissection as well as downstream forwarding. On the loopback path, pull skb_transport_offset(skb) to restore skb->data to the SRH before looping back.
Title ipv6: sr: restore network header before routing and forwarding
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T14:42:04.399Z

Reserved: 2026-09-25T10:19:56.076Z

Link: CVE-2026-98096

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-25T11:17:39.373

Modified: 2026-09-25T15:18:05.827

Link: CVE-2026-98096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T16:15:16Z

Weaknesses
  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE-125

    Out-of-bounds Read