{"id":"CVE-2026-98934","kind":"vulnerability","aliases":["CVE-2026-98934"],"related":[],"title":"Linux kernel: IPv6 segment routing flow hash can warn on missing netns","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()\n\nSince commit d58e468b1112 (\"flow_dissector: implements flow dissector\nBPF hook\") __skb_flow_dissect() needs a net pointer, either from\nskb->dev, skb->sk, or since commit 3cbf4ffba5ee (\"net: plumb network\nnamespace into __skb_flow_dissect\") a caller provided pointer.\n\nsyzbot was able to reach seg6_make_flowlabel() with an skb having\nneither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery\nmessage through an IPv4 route using seg6 encap, while\nnet.ipv6.seg6_flowlabel is set to 1.\n\nseg6_make_flowlabel() already has a net pointer, use skb_get_hash_net().\n\nWARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930\nCall trace:\n  __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P)\n  __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903\n  skb_get_hash include/linux/skbuff.h:1663 [inline]\n  seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132\n  __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161\n  seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431\n  seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681\n  seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744\n  lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356\n  dst_output include/net/dst.h:470 [inline]\n  ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131\n  iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97\n  udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187\n  tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202\n  tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274\n  tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576\n  tipc_enable_bearer net/tipc/bearer.c:366 [inline]\n  __tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048\n  tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057\n  genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114","summary":"The Linux kernel's IPv6 segment routing (seg6) flow label code called the flow dissector without a network namespace when the packet had no device or socket attached, which triggers a kernel warning. The sources describe this as a crash-type bug found by syzbot, and do not describe code execution or data theft.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipv6","linux-kernel","runtime","segment-routing","tipc"],"not_affected_if":["default-config","no-seg6-encap"],"how_to_check":"- Check whether `net.ipv6.seg6_flowlabel` is set to `1` with `sysctl net.ipv6.seg6_flowlabel`\n- Check whether the kernel uses seg6 encapsulation routes with `ip -6 route show | grep seg6`\n- Check the running kernel version with `uname -r` and compare it against the fixed stable release in the kernel git tree","fix":"- Update the Linux kernel to a release that includes the upstream commit that switches seg6_make_flowlabel() to skb_get_hash_net() (version unknown from the sources)\n- Until patched, consider keeping `net.ipv6.seg6_flowlabel` at `0` if seg6 flow labels are not needed (unverified mitigation)","status":"open","published_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:09+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:58:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit that switches seg6_make_flowlabel() to skb_get_hash_net() (version unknown from the sources)\n- Until patched, consider keeping `net.ipv6.seg6_flowlabel` at `0` if seg6 flow labels are not needed (unverified mitigation)","reach":"local","title":"Linux kernel: IPv6 segment routing flow hash can warn on missing netns","impact":"low","summary":"The Linux kernel's IPv6 segment routing (seg6) flow label code called the flow dissector without a network namespace when the packet had no device or socket attached, which triggers a kernel warning. The sources describe this as a crash-type bug found by syzbot, and do not describe code execution or data theft.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ipv6","segment-routing","tipc"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel warning and possible denial of service on affected hosts","analyst_note":"","how_to_check":"- Check whether `net.ipv6.seg6_flowlabel` is set to `1` with `sysctl net.ipv6.seg6_flowlabel`\n- Check whether the kernel uses seg6 encapsulation routes with `ip -6 route show | grep seg6`\n- Check the running kernel version with `uname -r` and compare it against the fixed stable release in the kernel git tree","needs_analyst":false,"not_affected_if":["default-config","no-seg6-encap"],"who_is_affected":"Systems running a Linux kernel with IPv6 segment routing encapsulation enabled and net.ipv6.seg6_flowlabel set to 1, where a TIPC UDP bearer or similar sends through an IPv4 route using seg6 encap. Hosts that do not use seg6 encapsulation are unlikely to be affected. The sources do not give further detail on who is exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000792,"input_tokens":4360,"output_tokens":712,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':203C,215C,224C,237C,245C,252C,259C,265C,271C,283C,289C,297C,304C,312C,320C,334C,342C,351C '-2026':14A,17A '-98934':15A,18A '0':208C '1':182C '1048':337C '1057':345C '1114':354C '1126':206C,218C '1131':198C '131':286C '132':240C '161':248C '1663':232C '187':300C '1903':227C '202':307C '274':315C '356':274C '366':328C '3cbf4ffba5ee':130C '431':255C '470':278C '576':323C '681':262C '744':268C '97':292C 'abl':145C 'alreadi':186C 'attach':55B 'bearer':165C,317C,326C,332C,340C 'bpf':112C 'bug':70B 'call':39B,210C 'caller':140C 'code':38B,78B 'commit':105C,129C 'core':258C 'cpu':207C 'crash':68B 'crash-typ':67B 'cve':13A,16A 'd58e468b1112':106C 'data':81B 'describ':63B,77B 'dev':124C,157C 'devic':52B 'discoveri':168C 'dissect':116C,138C,202C,214C 'dissector':42B,108C,111C 'doit':350C 'dst':275C 'either':121C 'enabl':325C,333C,341C 'encap':176C,244C 'execut':79B 'famili':347C 'flow':6A,36B,41B,107C,110C,115C,137C,201C,213C 'flowlabel':103C,150C,185C,236C 'follow':88C 'found':71B 'genl':346C 'get':97C,193C,221C,229C 'hash':7A,98C,194C,222C,230C 'hook':113C 'implement':109C 'include/linux/skbuff.h':231C 'include/net/dst.h':277C 'inlin':233C,279C,329C 'ip':280C 'iptunnel':287C 'ipv4':172C 'ipv6':3A,19B,32B,93C 'kernel':2A,22B,30B,59B,86C 'label':37B 'linux':1A,21B,29B,85C 'linux-kernel':20B 'local':281C 'lwtunnel':269C 'make':102C,149C,184C,235C 'messag':169C 'miss':11A 'msg':311C,349C 'namespac':46B,134C 'need':117C 'neither':155C 'net':99C,119C,131C,189C,195C,223C 'net.ipv6.seg6_flowlabel':178C 'net/core/flow_dissector.c':197C,205C,217C,226C 'net/core/lwtunnel.c':273C 'net/ipv4/ip_output.c':285C 'net/ipv4/ip_tunnel_core.c':291C 'net/ipv4/udp_tunnel_core.c':299C 'net/ipv6/seg6_iptunnel.c':239C,247C,254C,261C,267C 'net/netlink/genetlink.c':353C 'net/tipc/bearer.c':322C,327C,336C,344C 'net/tipc/udp_media.c':306C,314C 'netn':12A 'network':45B,133C 'nl':331C,339C 'output':257C,264C,270C,276C 'p':219C 'packet':49B 'plumb':132C 'pointer':120C,142C,190C 'provid':141C 'rcv':348C 'reach':147C 'resolv':92C 'rout':5A,26B,34B,173C 'runtim':23B 'seg6':35B,101C,148C,175C,183C,234C,241C,249C,256C,263C 'segment':4A,25B,33B 'segment-rout':24B 'send':166C,310C 'set':161C,180C 'sinc':104C,128C 'sk':126C,160C 'skb':96C,114C,123C,125C,136C,153C,156C,159C,192C,200C,212C,220C,228C,296C,319C 'socket':54B 'sourc':62B 'sr':94C 'srh':243C,251C 'syz.0.17/4930':209C 'syzbot':73B,143C 'theft':82B 'tipc':27B,163C,301C,308C,316C,324C,330C,338C 'trace':211C 'trigger':57B 'tunnel':294C 'type':69B 'udp':164C,293C,302C,309C 'use':95C,174C,191C 'vulner':89C 'warn':9A,60B,196C 'without':43B 'x110/0x148':284C 'x164/0x688':260C 'x1e4/0x2d4':352C 'x214/0x374':313C 'x220/0x348':298C 'x260/0x3b0':321C 'x2c/0x48':343C 'x320/0xbf4':246C 'x3d0/0x664':272C 'x44/0x1ac':266C 'x4b4/0xa44':253C 'x50c/0xd38':290C 'x75c/0x9c0':305C 'x910/0x5368':204C,216C 'xc90/0xfb0':335C 'xcc/0x1ec':238C 'xe0/0x29c':225C 'xmit':288C,295C,303C,318C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with IPv6 segment routing encapsulation enabled and net.ipv6.seg6_flowlabel set to 1, where a TIPC UDP bearer or similar sends through an IPv4 route using seg6 encap. Hosts that do not use seg6 encapsulation are unlikely to be affected. The sources do not give further detail on who is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98934","severity":null,"published_at":"2026-10-23T13:17:14+00:00","modified_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98934","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98934","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}