---
id: CVE-2026-98531
title: 'ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

  In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
  .len = sizeof(struct in6_addr). Fo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    050a0aa3c80907b8c60a396b7e04d48d8b1a9e70
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    209eefebee54c4a5f01d68b61e8ac9881eca2de9
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    e3ac68c1cdc2535d127b2bfd50c263d16c8e4199
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    66bf65fa109326e4c4ddeb0b94093379f72838fd
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    195813bb7324c338eaba0aaa02b18681ee65b670
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    6fcfc362344edea745a69f3a705de50b731f3418
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e
  - >-
    Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <
    2d959c75c27f90e9ec489d18ce5ee6b852ad4741
  - Linux 4.10
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:17:49.632Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98531'
references:
  - url: 'https://git.kernel.org/stable/c/050a0aa3c80907b8c60a396b7e04d48d8b1a9e70'
  - url: 'https://git.kernel.org/stable/c/209eefebee54c4a5f01d68b61e8ac9881eca2de9'
  - url: 'https://git.kernel.org/stable/c/e3ac68c1cdc2535d127b2bfd50c263d16c8e4199'
  - url: 'https://git.kernel.org/stable/c/66bf65fa109326e4c4ddeb0b94093379f72838fd'
  - url: 'https://git.kernel.org/stable/c/195813bb7324c338eaba0aaa02b18681ee65b670'
  - url: 'https://git.kernel.org/stable/c/6fcfc362344edea745a69f3a705de50b731f3418'
  - url: 'https://git.kernel.org/stable/c/94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e'
  - url: 'https://git.kernel.org/stable/c/2d959c75c27f90e9ec489d18ce5ee6b852ad4741'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.279Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and
.len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the
maximum payload length and permits shorter payloads (e.g., 0 bytes).
When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via
kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute
triggers a 16-byte out-of-bounds read past skb->tail into uninitialized
skb->head memory, which is stored in sdata->tun_src and leaked back to
userspace via SEG6_CMD_GET_TUNSRC.

Switch SEG6_ATTR_DST in seg6_genl_policy to
NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink
validation rejects any attribute whose length is not exactly
sizeof(struct in6_addr) with -ERANGE.

Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC
Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed
by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC
succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of
uninitialized kernel heap memory (tun_src =
836a61ecc4d25a1042a8d60411cfb378); with this patch applied,
SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with
-ERANGE (-34) and tun_src remains zeroed.

## Affected

- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 050a0aa3c80907b8c60a396b7e04d48d8b1a9e70`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 209eefebee54c4a5f01d68b61e8ac9881eca2de9`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < e3ac68c1cdc2535d127b2bfd50c263d16c8e4199`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 66bf65fa109326e4c4ddeb0b94093379f72838fd`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 195813bb7324c338eaba0aaa02b18681ee65b670`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 6fcfc362344edea745a69f3a705de50b731f3418`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e`
- `Linux >= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa < 2d959c75c27f90e9ec489d18ce5ee6b852ad4741`
- `Linux 4.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.