CVE-2026-98802: seg6: ensure packet data is writable before modifying SRH and IPv6 DA

In the Linux kernel, the following vulnerability has been resolved:

seg6: ensure packet data is writable before modifying SRH and IPv6 DA

advancenextseg() modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg() has the same problem when it advances the NEXT-C-SID argument in the destination address.

The skb may be cloned, for example by an AFPACKET socket receiving on the ingress device. advancenextseg() and seg6nextcsidadvancearg() then write into the packet data shared with the clone. A read from that socket can return the modified packet instead of the received one. The simplified path below shows this for advancenextseg():

netifreceiveskbonecore netifreceiveskbcore deliverskb [orig: users=2, cloned=0] packetrcv skbclone clone queued to the AFPACKET socket consumeskb(orig) [orig: users=1, cloned=1] ipv6rcv ip6rcvcore skbsharecheck: no-op [orig: users=1] [...] inputactionendcore advancenextseg writes into the data shared with the clone

Call skbensurewritable() in advancenextseg() and in seg6nextcsidadvancearg() before they modify the packet data. skbensurewritable() may reallocate skb->head, which invalidates the pointers into the packet data taken before the call. advancenextseg() now returns a valid SRH pointer, or NULL if skbensurewritable() fails. seg6nextcsidadvancearg() takes the pointer to the destination address from the skb after skbensurewritable(). On failure, the callers drop the packet with SKBDROPREASONNOMEM.