{"id":"CVE-2026-98802","kind":"vulnerability","aliases":["CVE-2026-98802"],"related":[],"title":"Linux kernel: SRv6 packet writes can corrupt packets shared with sockets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: ensure packet data is writable before modifying SRH and IPv6 DA\n\nadvance_nextseg() modifies the SRH Segments Left field and the IPv6\ndestination address without ensuring the packet data is writable.\nseg6_next_csid_advance_arg() has the same problem when it advances the\nNEXT-C-SID argument in the destination address.\n\nThe skb may be cloned, for example by an AF_PACKET socket receiving on\nthe ingress device. advance_nextseg() and seg6_next_csid_advance_arg()\nthen write into the packet data shared with the clone. A read from that\nsocket can return the modified packet instead of the received one. The\nsimplified path below shows this for advance_nextseg():\n\n__netif_receive_skb_one_core\n  __netif_receive_skb_core\n    deliver_skb               [orig: users=2, cloned=0]\n      packet_rcv\n        skb_clone             clone queued to the AF_PACKET socket\n        consume_skb(orig)     [orig: users=1, cloned=1]\n  ipv6_rcv\n    ip6_rcv_core              skb_share_check: no-op [orig: users=1]\n    [...]\n      input_action_end_core\n        advance_nextseg       writes into the data shared with the clone\n\nCall skb_ensure_writable() in advance_nextseg() and in\nseg6_next_csid_advance_arg() before they modify the packet data.\nskb_ensure_writable() may reallocate skb->head, which invalidates the\npointers into the packet data taken before the call.\nadvance_nextseg() now returns a valid SRH pointer, or NULL if\nskb_ensure_writable() fails.\nseg6_next_csid_advance_arg() takes the pointer to the destination\naddress from the skb after skb_ensure_writable().\nOn failure, the callers drop the packet with SKB_DROP_REASON_NOMEM.","summary":"The Linux kernel's seg6 (SRv6) code modifies the Segment Routing Header and IPv6 destination address in packet data without first making it writable, so a cloned packet (for example one captured by an AF_PACKET socket) can be altered. A local process reading from that socket can receive a modified packet instead of the one that arrived.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","seg6","self-hosted","srv6"],"not_affected_if":["no-srv6-config"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit adding skb_ensure_writable() to advance_nextseg() and seg6_next_csid_advance_arg(); the sources do not name the fixed version.","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:03+00:00","updated_at":"2026-10-25T05:15:03+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:15:03Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit adding skb_ensure_writable() to advance_nextseg() and seg6_next_csid_advance_arg(); the sources do not name the fixed version.","reach":"network","title":"Linux kernel: SRv6 packet writes can corrupt packets shared with sockets","impact":"low","summary":"The Linux kernel's seg6 (SRv6) code modifies the Segment Routing Header and IPv6 destination address in packet data without first making it writable, so a cloned packet (for example one captured by an AF_PACKET socket) can be altered. A local process reading from that socket can receive a modified packet instead of the one that arrived.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","srv6","seg6","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"packet capture reads modified packets instead of received ones","analyst_note":"Check the NVD entry and the linked kernel stable commits for the fixed kernel versions and CVSS score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-srv6-config"],"who_is_affected":"Systems running the Linux kernel with SRv6 (seg6) segment routing enabled and End-type SRH processing configured, where packets are also received by AF_PACKET sockets such as packet capture tools. Hosts that do not use SRv6 are unlikely to be affected; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":3851,"output_tokens":551,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98802':14A,17A '0':223C '1':240C,242C,256C '2':221C 'action':258C 'address':42B,119C,148C,336C 'advanc':107C,130C,138C,166C,172C,206C,261C,276C,283C,310C,328C 'af':61B,158C,232C 'alter':66B 'arg':131C,173C,284C,329C 'argument':144C 'arriv':84B 'c':142C 'call':271C,309C 'caller':347C 'captur':58B 'check':250C 'clone':53B,153C,183C,222C,227C,228C,241C,270C 'code':33B 'consum':235C 'core':212C,216C,247C,260C 'corrupt':7A 'csid':129C,171C,282C,327C 'cve':12A,15A 'da':106C 'data':45B,98C,124C,179C,266C,290C,305C 'deliv':217C 'destin':41B,118C,147C,335C 'devic':165C 'drop':348C,353C 'end':259C 'ensur':96C,121C,273C,292C,322C,342C 'exampl':56B,155C 'fail':324C 'failur':345C 'field':114C 'first':47B 'follow':90C 'head':297C 'header':38B 'host':25B 'ingress':164C 'input':257C 'instead':79B,194C 'invalid':299C 'ip6':245C 'ipv6':40B,105C,117C,243C 'kernel':2A,20B,29B,88C 'left':113C 'linux':1A,19B,28B,87C 'linux-kernel':18B 'local':68B 'make':48B 'may':151C,294C 'modifi':34B,77B,102C,109C,192C,287C 'netif':208C,213C 'next':128C,141C,170C,281C,326C 'next-c-sid':140C 'nextseg':108C,167C,207C,262C,277C,311C 'no-op':251C 'nomem':355C 'null':319C 'one':57B,82B,198C,211C 'op':253C 'orig':219C,237C,238C,254C 'packet':4A,8A,44B,54B,62B,78B,97C,123C,159C,178C,193C,224C,233C,289C,304C,350C 'path':201C 'pointer':301C,317C,332C 'problem':135C 'process':69B 'queu':229C 'rcv':225C,244C,246C 'read':70B,185C 'realloc':295C 'reason':354C 'receiv':75B,161C,197C,209C,214C 'resolv':94C 'return':190C,313C 'rout':37B 'runtim':21B 'seg6':22B,31B,95C,127C,169C,280C,325C 'segment':36B,112C 'self':24B 'self-host':23B 'share':9A,180C,249C,267C 'show':203C 'sid':143C 'simplifi':200C 'skb':150C,210C,215C,218C,226C,236C,248C,272C,291C,296C,321C,339C,341C,352C 'socket':11A,63B,73B,160C,188C,234C 'srh':103C,111C,316C 'srv6':3A,26B,32B 'take':330C 'taken':306C 'user':220C,239C,255C 'valid':315C 'vulner':91C 'without':46B,120C 'writabl':50B,100C,126C,274C,293C,323C,343C 'write':5A,175C,263C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with SRv6 (seg6) segment routing enabled and End-type SRH processing configured, where packets are also received by AF_PACKET sockets such as packet capture tools. Hosts that do not use SRv6 are unlikely to be affected; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98802","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-19T10:19:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}