UBUNTU-CVE-2026-98934: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet() in seg6makeflowlabel() Since commit d58e468b1112 ("flowdissector: implements flow dissector BPF hook") skbflowdissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into skbflowdissect") a caller provided pointer. syzbot was able to reach seg6makeflowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6flowlabel is set to 1. seg6makeflowlabel() already has a net pointer, use skbgethashnet(). WARNING: net/core/flowdissector.c:1131 at skbflowdissect+0x910/0x5368 net/core/flowdissector.c:1126, CPU#0: syz.0.17/4930 Call trace: skbflowdissect+0x910/0x5368 net/core/flowdissector.c:1126 (P) skbgethashnet+0xe0/0x29c net/core/flowdissector.c:1903 skbgethash include/linux/skbuff.h:1663 [inline] seg6makeflowlabel+0xcc/0x1ec net/ipv6/seg6iptunnel.c:132 seg6dosrhencap+0x320/0xbf4 net/ipv6/seg6iptunnel.c:161 seg6dosrh+0x4b4/0xa44 net/ipv6/seg6iptunnel.c:431 seg6outputcore+0x164/0x688 net/ipv6/seg6iptunnel.c:681 seg6output+0x44/0x1ac net/ipv6/seg6iptunnel.c:744 lwtunneloutput+0x3d0/0x664 net/core/lwtunnel.c:356 dstoutput include/net/dst.h:470 [inline] iplocalout+0x110/0x148 net/ipv4/ipoutput.c:131 iptunnelxmit+0x50c/0xd38 net/ipv4/iptunnelcore.c:97 udptunnelxmitskb+0x220/0x348 net/ipv4/udptunnelcore.c:187 tipcudpxmit+0x75c/0x9c0 net/tipc/udpmedia.c:202 tipcudpsendmsg+0x214/0x374 net/tipc/udpmedia.c:274 tipcbearerxmitskb+0x260/0x3b0 net/tipc/bearer.c:576 tipcenablebearer net/tipc/bearer.c:366 [inline] tipcnlbearerenable+0xc90/0xfb0 net/tipc/bearer.c:1048 tipcnlbearerenable+0x2c/0x48 net/tipc/bearer.c:1057 genlfamilyrcvmsgdoit+0x1e4/0x2d4 net/netlink/genetlink.c:1114
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.74~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.82~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1071.78~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.81~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.70~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1067.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149~22.04.2 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1064.65~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-149.149 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1068.77 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1053.57 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1069.70 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1067.71 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1068.72 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1~24.04.2 - Upgrade
Upgrade
ubuntu/linux-vmwareto a version that resolves this vulnerability.Fixed in 6.8.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1036.41 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2056.58 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1064.65 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-43.43 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1017.18 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1017.19 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Compensating control
Modify seg6_make_flowlabel() to use skb_get_hash_net() with its existing net pointer instead of skb_get_hash().
Event History
Frequently Asked Questions
What configuration and traffic path are required to trigger this issue?
The reported trigger requires net.ipv6.seg6_flowlabel to be set to 1 and Segment Routing IPv6 encapsulation to be used. The observed path involved a TIPC UDP bearer sending a discovery message through an IPv4 route using SEG6 encapsulation.
Is a system using the listed Ubuntu kernel packages affected by default?
The provided information identifies a trigger that depends on enabling net.ipv6.seg6_flowlabel and using the specified SEG6 encapsulation path. It does not state whether that sysctl is enabled by default or whether the required TIPC and routing configuration is present by default.
What can be done if an updated kernel cannot be deployed immediately?
Avoid the reported trigger conditions by keeping net.ipv6.seg6_flowlabel disabled and avoiding the affected TIPC UDP discovery traffic path through an IPv4 route with SEG6 encapsulation. The data does not provide additional mitigations.
How can administrators determine whether they may be exposed?
Review whether net.ipv6.seg6_flowlabel is set to 1 and whether the host uses SEG6 encapsulation, particularly for TIPC UDP bearer discovery traffic routed over IPv4. Systems without that combination are not described as reaching the reported warning path.