CVE-2026-98383: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpfskbpulldata() for LWTSEG6LOCAL
An LWTSEG6LOCAL program can invalidate its cached SRH with bpflwtseg6adjustsrh() and then call bpfskbpulldata(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer.
Disallow bpfskbpulldata() for LWTSEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwtoutfuncproto().
Affected Software
Event History
Frequently Asked Questions
What configuration is exposed to this issue?
Exposure requires an LWT_SEG6LOCAL BPF program. The unsafe sequence is specific to programs that use bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data().
What does the fix change for existing BPF programs?
The verifier rejects bpf_skb_pull_data() in LWT_SEG6LOCAL programs. Other LWT program types continue to have access to this helper through lwt_out_func_proto().
How can I determine whether deployed programs need review?
Review LWT_SEG6LOCAL BPF programs for a call to bpf_lwt_seg6_adjust_srh() followed by bpf_skb_pull_data(). That combination can invalidate the cached SRH pointer and lead to post-program validation writing through a dangling pointer.