CVE-2026-98802

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

seg6: ensure packet data is writable before modifying SRH and IPv6 DA

advance_nextseg() modifies the SRH Segments Left field and the IPv6

destination address without ensuring the packet data is writable.

seg6_next_csid_advance_arg() has the same problem when it advances the

NEXT-C-SID argument in the destination address.

The skb may be cloned, for example by an AF_PACKET socket receiving on

the ingress device. advance_nextseg() and seg6_next_csid_advance_arg()

then write into the packet data shared with the clone. A read from that

socket can return the modified packet instead of the received one. The

simplified path below shows this for advance_nextseg():

__netif_receive_skb_one_core

__netif_receive_skb_core

deliver_skb [orig: users=2, cloned=0]

packet_rcv

skb_clone clone queued to the AF_PACKET socket

consume_skb(orig) [orig: users=1, cloned=1]

ipv6_rcv

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References