CVE-2026-98383 - Vulnerability Details

- bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.

Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().

Published: 2026-10-09

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An LWT_SEG6LOCAL BPF program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation subsequently writes through that unstable pointer, potentially corrupting kernel memory. This vulnerability is a manifestation of a resource handling error (CWE-825).

Affected Systems

All Linux kernel versions that implement LWT_SEG6LOCAL BPF programs and expose the bpf_skb_pull_data helper are affected. Specific version information is not provided, so any kernel prior to the patch that allows this helper combination is considered vulnerable. Updated kernels that reject the helper are no longer affected.

Risk and Exploitability

The EPSS score is <1%, indicating a low likelihood of exploitation. The CVSS score of 7.8 reflects high severity. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of the vulnerability, the attack likely requires local access to load an LWT_SEG6LOCAL BPF program (inferred). Potential impact involves kernel memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< 0f38472a2aa8704a6b514c0dfa9c32f3672b8f32
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< cae8674489f26edf7553fdd660599466cbb4c32f
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< 9f9e57b5a3a033f95f49ef9d541340cdbcb80abb
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< df0072be6fc373cb22f9ea854d458b04e32a03cf
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< b9bb0e735460751b620156f800a4279a28573392
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< 37b18688cd18fd86d2f35c212df1611862a26cd5
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< fca71ead7a20290af1e2046983eeafae43d21af1
`004d4b274e2a1a895a0e5dc66158b90a7d463d44`	affected	< e4a62833adff6ef0fe7c0b90393204fe3c26b5c5

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,0f38472a2aa8704a6b514c0dfa9c32f3672b8f32)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,cae8674489f26edf7553fdd660599466cbb4c32f)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,9f9e57b5a3a033f95f49ef9d541340cdbcb80abb)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,df0072be6fc373cb22f9ea854d458b04e32a03cf)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,b9bb0e735460751b620156f800a4279a28573392)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,37b18688cd18fd86d2f35c212df1611862a26cd5)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,fca71ead7a20290af1e2046983eeafae43d21af1)`	affected	code_commit	—
`[004d4b274e2a1a895a0e5dc66158b90a7d463d44,e4a62833adff6ef0fe7c0b90393204fe3c26b5c5)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3-rc5,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch disallowing bpf_skb_pull_data() for LWT_SEG6LOCAL programs. This patch rejects the dangerous helper combination at loading time.
If an immediate kernel upgrade is not feasible, restrict the loading of LWT_SEG6LOCAL BPF programs (for example, by using kernel command-line options or BPF program filtering mechanisms) to prevent an attacker from submitting such programs.
Monitor system logs and kernel panics for signs of SRH pointer dereference attempts, and apply broader kernel hardening measures such as SELinux or AppArmor profiles to limit BPF program capabilities.

Generated by OpenCVE AI on October 24, 2026 at 17:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00162.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98383.mbox
https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32
https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5
https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb
https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392
https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f
https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf
https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5
https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1
https://nvd.nist.gov/vuln/detail/CVE-2026-98383
https://www.cve.org/CVERecord?id=CVE-2026-98383

History

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 11 Oct 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sun, 11 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98383.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98383 https://www.cve.org/CVERecord?id=CVE-2026-98383
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 09 Oct 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 09 Oct 2026 08:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer. Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwt_out_func_proto().
Title		bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32 https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5 https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392 https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-09T07:34:22.408Z

Updated: 2026-10-24T14:08:40.964Z

Reserved: 2026-09-25T10:25:14.345Z

Link: CVE-2026-98383

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-09T08:16:56.800

Modified: 2026-10-24T14:16:40.360

Link: CVE-2026-98383

Redhat

Severity : Moderate

Publid Date: 2026-10-09T00:00:00Z

Links: CVE-2026-98383 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T17:45:13Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object