---
id: "CVE-2026-98934"
kind: "vulnerability"
aliases: ["CVE-2026-98934"]
title: "Linux kernel: IPv6 segment routing flow hash can warn on missing netns"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ipv6", "linux-kernel", "runtime", "segment-routing", "tipc"]
not_affected_if: ["default-config", "no-seg6-encap"]
published_at: "2026-10-23T13:17:14+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98934", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98934", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: IPv6 segment routing flow hash can warn on missing netns

The Linux kernel's IPv6 segment routing (seg6) flow label code called the flow dissector without a network namespace when the packet had no device or socket attached, which triggers a kernel warning. The sources describe this as a crash-type bug found by syzbot, and do not describe code execution or data theft.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `net.ipv6.seg6_flowlabel` is set to `1` with `sysctl net.ipv6.seg6_flowlabel`
- Check whether the kernel uses seg6 encapsulation routes with `ip -6 route show | grep seg6`
- Check the running kernel version with `uname -r` and compare it against the fixed stable release in the kernel git tree

## Fix

- Update the Linux kernel to a release that includes the upstream commit that switches seg6_make_flowlabel() to skb_get_hash_net() (version unknown from the sources)
- Until patched, consider keeping `net.ipv6.seg6_flowlabel` at `0` if seg6 flow labels are not needed (unverified mitigation)

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98934
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98934

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

Since commit d58e468b1112 ("flow_dissector: implements flow dissector
BPF hook") __skb_flow_dissect() needs a net pointer, either from
skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network
namespace into __skb_flow_dissect") a caller provided pointer.

syzbot was able to reach seg6_make_flowlabel() with an skb having
neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery
message through an IPv4 route using seg6 encap, while
net.ipv6.seg6_flowlabel is set to 1.

seg6_make_flowlabel() already has a net pointer, use skb_get_hash_net().

WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930
Call trace:
  __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P)
  __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903
  skb_get_hash include/linux/skbuff.h:1663 [inline]
  seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132
  __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161
  seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431
  seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681
  seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744
  lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356
  dst_output include/net/dst.h:470 [inline]
  ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131
  iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97
  udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187
  tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202
  tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274
  tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576
  tipc_enable_bearer net/tipc/bearer.c:366 [inline]
  __tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048
  tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057
  genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_