---
id: CVE-2026-98802
title: 'seg6: ensure packet data is writable before modifying SRH and IPv6 DA'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  seg6: ensure packet data is writable before modifying SRH and IPv6 DA

  advance_nextseg() modifies the SRH Segments Left field and the IPv6
  destination address without e…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 140f04c33bbcf89440dcaf8bef04918abff5a52d <
    e9141fdb7a2ead48cfcd60c681aba91d3014255b
  - >-
    Linux >= 140f04c33bbcf89440dcaf8bef04918abff5a52d <
    8ae3f4067ba4ae3a15581392f6dac422e3d3def0
  - Linux 4.14
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:48:49.192Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98802'
references:
  - url: 'https://git.kernel.org/stable/c/e9141fdb7a2ead48cfcd60c681aba91d3014255b'
  - url: 'https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.482Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

seg6: ensure packet data is writable before modifying SRH and IPv6 DA

advance_nextseg() modifies the SRH Segments Left field and the IPv6
destination address without ensuring the packet data is writable.
seg6_next_csid_advance_arg() has the same problem when it advances the
NEXT-C-SID argument in the destination address.

The skb may be cloned, for example by an AF_PACKET socket receiving on
the ingress device. advance_nextseg() and seg6_next_csid_advance_arg()
then write into the packet data shared with the clone. A read from that
socket can return the modified packet instead of the received one. The
simplified path below shows this for advance_nextseg():

__netif_receive_skb_one_core
  __netif_receive_skb_core
    deliver_skb               [orig: users=2, cloned=0]
      packet_rcv
        skb_clone             clone queued to the AF_PACKET socket
        consume_skb(orig)     [orig: users=1, cloned=1]
  ipv6_rcv
    ip6_rcv_core              skb_share_check: no-op [orig: users=1]
    [...]
      input_action_end_core
        advance_nextseg       writes into the data shared with the clone

Call skb_ensure_writable() in advance_nextseg() and in
seg6_next_csid_advance_arg() before they modify the packet data.
skb_ensure_writable() may reallocate skb->head, which invalidates the
pointers into the packet data taken before the call.
advance_nextseg() now returns a valid SRH pointer, or NULL if
skb_ensure_writable() fails.
seg6_next_csid_advance_arg() takes the pointer to the destination
address from the skb after skb_ensure_writable().
On failure, the callers drop the packet with SKB_DROP_REASON_NOMEM.

## Affected

- `Linux >= 140f04c33bbcf89440dcaf8bef04918abff5a52d < e9141fdb7a2ead48cfcd60c681aba91d3014255b`
- `Linux >= 140f04c33bbcf89440dcaf8bef04918abff5a52d < 8ae3f4067ba4ae3a15581392f6dac422e3d3def0`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.