CVE-2026-98934 - Vulnerability Details

- ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

Since commit d58e468b1112 ("flow_dissector: implements flow dissector
BPF hook") __skb_flow_dissect() needs a net pointer, either from
skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network
namespace into __skb_flow_dissect") a caller provided pointer.

syzbot was able to reach seg6_make_flowlabel() with an skb having
neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery
message through an IPv4 route using seg6 encap, while
net.ipv6.seg6_flowlabel is set to 1.

seg6_make_flowlabel() already has a net pointer, use skb_get_hash_net().

WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930
Call trace:
__skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P)
__skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903
skb_get_hash include/linux/skbuff.h:1663 [inline]
seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132
__seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161
seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431
seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681
seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744
lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356
dst_output include/net/dst.h:470 [inline]
ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131
iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97
udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187
tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202
tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274
tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576
tipc_enable_bearer net/tipc/bearer.c:366 [inline]
__tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048
tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057
genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114

Published: 2026-10-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the IPv6 segment routing implementation (seg6_make_flowlabel) allows a crafted packet to cause a null pointer dereference in the kernel's flow dissection logic. Based on the description, it is inferred that this dereference would trigger a kernel panic, aborting packet‑processing threads and bringing the system down. The effect is a denial of service without providing code execution or privilege escalation.

Affected Systems

All Linux kernel builds that include segment routing (seg6) before the patch that adds skb_get_hash_net() to seg6_make_flowlabel are affected. The vulnerability is present regardless of vendor or distribution; any system shipping an unpatched kernel with net.ipv6.seg6_flowlabel enabled or that sends segmented packets via TIPC may exercise the vulnerable path.

Risk and Exploitability

The CVSS score of 5.5 reflects moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must send a crafted IPv4 packet containing an IPv6 segment routing header through a TIPC UDP bearer with net.ipv6.seg6_flowlabel set to 1. This requires network access to the vulnerable interface, so the overall risk remains moderate and largely depends on the configuration and exposure of the vulnerable port.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< de83419b5062a6f83bb9421be77cae734cbead65
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< 8407a2c1aa67c2a110a576df8f82a4e259188b82
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< a43d96620d080b1b2324a53e38dd7b4bff4825c1
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< 4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< 8fe3d6717f5536793727e60b7a0b7ec20c697def
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< 53b21bc2df6e8ed538bceda93a5104a5fe6a8a84
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< 086e8acb3a0e55f6d22d29fae2a4a3b1561bb766
`d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9`	affected	< 8ec454dcd00ce3375119111c6394964455b36d0d

Linux

affected

Version	Status	Constraints
`4.20`	affected	—
`0`	unaffected	< 4.20
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,8fe3d6717f5536793727e60b7a0b7ec20c697def)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,53b21bc2df6e8ed538bceda93a5104a5fe6a8a84)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,086e8acb3a0e55f6d22d29fae2a4a3b1561bb766)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,8ec454dcd00ce3375119111c6394964455b36d0d)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,8fe3d6717f5536793727e60b7a0b7ec20c697def)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,53b21bc2df6e8ed538bceda93a5104a5fe6a8a84)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,086e8acb3a0e55f6d22d29fae2a4a3b1561bb766)`	affected	code_commit	—
`[d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9,8ec454dcd00ce3375119111c6394964455b36d0d)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`4.20`	affected	generic	—
`[0,4.20)`	unaffected	generic	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the seg6_make_flowlabel patch or a later kernel version with the fix.
Disable segment routing flow labeling by setting sysctl net.ipv6.seg6_flowlabel to 0 to prevent execution of the vulnerable code path.
Limit or disable TIPC or other services that send segmented packets until the patch is applied to reduce the attack surface.

Generated by OpenCVE AI on October 29, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/086e8acb3a0e55f6d22d29fae2a4a3b1561bb766
https://git.kernel.org/stable/c/4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3
https://git.kernel.org/stable/c/53b21bc2df6e8ed538bceda93a5104a5fe6a8a84
https://git.kernel.org/stable/c/8407a2c1aa67c2a110a576df8f82a4e259188b82
https://git.kernel.org/stable/c/8ec454dcd00ce3375119111c6394964455b36d0d
https://git.kernel.org/stable/c/8fe3d6717f5536793727e60b7a0b7ec20c697def
https://git.kernel.org/stable/c/a43d96620d080b1b2324a53e38dd7b4bff4825c1
https://git.kernel.org/stable/c/de83419b5062a6f83bb9421be77cae734cbead65
https://nvd.nist.gov/vuln/detail/CVE-2026-98934
https://www.cve.org/CVERecord?id=CVE-2026-98934

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/8407a2c1aa67c2a110a576df8f82a4e259188b82 https://git.kernel.org/stable/c/a43d96620d080b1b2324a53e38dd7b4bff4825c1 https://git.kernel.org/stable/c/de83419b5062a6f83bb9421be77cae734cbead65

Thu, 29 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://nvd.nist.gov/vuln/detail/CVE-2026-98934 https://www.cve.org/CVERecord?id=CVE-2026-98934
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 23 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") a caller provided pointer. syzbot was able to reach seg6_make_flowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6_flowlabel is set to 1. seg6_make_flowlabel() already has a net pointer, use skb_get_hash_net(). WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930 Call trace: __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P) __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903 skb_get_hash include/linux/skbuff.h:1663 [inline] seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132 __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161 seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431 seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681 seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744 lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356 dst_output include/net/dst.h:470 [inline] ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131 iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97 udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187 tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202 tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274 tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576 tipc_enable_bearer net/tipc/bearer.c:366 [inline] __tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048 tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114
Title		ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/086e8acb3a0e55f6d22d29fae2a4a3b1561bb766 https://git.kernel.org/stable/c/4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3 https://git.kernel.org/stable/c/53b21bc2df6e8ed538bceda93a5104a5fe6a8a84 https://git.kernel.org/stable/c/8ec454dcd00ce3375119111c6394964455b36d0d https://git.kernel.org/stable/c/8fe3d6717f5536793727e60b7a0b7ec20c697def

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:11:43.459Z

Updated: 2026-10-30T12:40:23.809Z

Reserved: 2026-09-25T10:25:14.381Z

Link: CVE-2026-98934

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:14.253

Modified: 2026-10-30T13:21:31.863

Link: CVE-2026-98934

Redhat

Severity : Moderate

Publid Date: 2026-10-23T12:11:43Z

Links: CVE-2026-98934 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T22:45:03Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object