CVE-2026-98531: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: enforce exact attribute length for SEG6ATTRDST
In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeof(struct in6addr). For NLABINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6genlsettunsrc() copies sizeof(struct in6addr) bytes via kmemdup(val, sizeof(val), GFPKERNEL), a short SEG6ATTRDST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tunsrc and leaked back to userspace via SEG6CMDGETTUNSRC.
Switch SEG6ATTRDST in seg6genlpolicy to NLAPOLICYEXACTLEN(sizeof(struct in6addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6addr) with -ERANGE.
Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6CMDSETTUNSRC Generic Netlink message with a 0-byte SEG6ATTRDST attribute followed by SEG6CMDGETTUNSRC. On the unfixed kernel, SEG6CMDSETTUNSRC succeeds (err = 0) and SEG6CMDGETTUNSRC leaks 16 bytes of uninitialized kernel heap memory (tunsrc = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6CMDSETTUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tunsrc remains zeroed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Switch SEG6_ATTR_DST in seg6_genl_policy from NLA_BINARY with .len = sizeof(struct in6_addr) to NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so generic netlink rejects attributes whose length is not exactly sizeof(struct in6_addr).
Linux kernel IPv6 SR (seg6_genl_policy) SEG6_ATTR_DST policy = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr))
Event History
Frequently Asked Questions
What access does an attacker need to trigger the leak?
An attacker needs to be able to send Generic Netlink SEG6_CMD_SET_TUNSRC and SEG6_CMD_GET_TUNSRC messages. The issue is triggered by supplying a SEG6_ATTR_DST attribute shorter than the required IPv6 address size, including a zero-byte attribute.
What information can be exposed?
On an unfixed kernel, the short attribute causes a 16-byte out-of-bounds read into uninitialized skb head memory. Those bytes are stored as the tunnel source and can be returned to userspace through SEG6_CMD_GET_TUNSRC.
How does the fix change affected behavior?
The fix requires SEG6_ATTR_DST to be exactly the size of struct in6_addr. Generic Netlink rejects shorter or otherwise incorrectly sized attributes with -ERANGE, rather than accepting them and copying 16 bytes.
How can I check whether a kernel is vulnerable?
Send SEG6_CMD_SET_TUNSRC with a zero-byte SEG6_ATTR_DST, then query it with SEG6_CMD_GET_TUNSRC. The described unfixed behavior is that the set request succeeds and the subsequent get request returns 16 bytes of uninitialized kernel memory.