In the Linux kernel, the following vulnerability has been resolved:

bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.

Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32 cve-icon cve-icon
https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5 cve-icon cve-icon
https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb cve-icon cve-icon
https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392 cve-icon cve-icon
https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f cve-icon cve-icon
https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf cve-icon cve-icon
https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 cve-icon cve-icon
https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1 cve-icon cve-icon
History

Fri, 09 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 09 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer. Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwt_out_func_proto().
Title bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-09T07:34:22.408Z

Reserved: 2026-09-25T10:25:14.345Z

Link: CVE-2026-98383

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-09T08:16:56.800

Modified: 2026-10-09T08:16:56.800

Link: CVE-2026-98383

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T09:30:03Z

Weaknesses