Linux Kernel LWT_SEG6LOCAL bpf_skb_pull_data() Dangling Pointer CVE-2026-98383
CVE-2026-98383 Published on October 9, 2026
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().
Products Associated with CVE-2026-98383
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below 0f38472a2aa8704a6b514c0dfa9c32f3672b8f32 is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below cae8674489f26edf7553fdd660599466cbb4c32f is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below 9f9e57b5a3a033f95f49ef9d541340cdbcb80abb is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below df0072be6fc373cb22f9ea854d458b04e32a03cf is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below b9bb0e735460751b620156f800a4279a28573392 is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below 37b18688cd18fd86d2f35c212df1611862a26cd5 is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below fca71ead7a20290af1e2046983eeafae43d21af1 is affected.
- Version 004d4b274e2a1a895a0e5dc66158b90a7d463d44 and below e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 is affected.
- Version 4.18 is affected.
- Before 4.18 is unaffected.
- Version 5.10.271, <= 5.10.* is unaffected.
- Version 5.15.222, <= 5.15.* is unaffected.
- Version 6.1.189, <= 6.1.* is unaffected.
- Version 6.6.158, <= 6.6.* is unaffected.
- Version 6.12.112, <= 6.12.* is unaffected.
- Version 6.18.55, <= 6.18.* is unaffected.
- Version 7.2.9, <= 7.2.* is unaffected.
- Version 7.3-rc5, <= * is unaffected.