CVE-2026-98383: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98383 Overview

CVE-2026-98383 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw affects Lightweight Tunnel Segment Routing over IPv6 Local (LWT_SEG6LOCAL) programs that combine bpf_lwt_seg6_adjust_srh() with bpf_skb_pull_data(). The latter helper may reallocate skb->head, leaving the per-CPU Segment Routing Header (SRH) pointer dangling. Post-program SRH validation then writes through that stale pointer, producing a use-after-free condition in kernel memory.

The upstream fix rejects bpf_skb_pull_data() in the verifier for LWT_SEG6LOCAL program types. Other Lightweight Tunnel (LWT) program types continue to expose the helper through lwt_out_func_proto().

Critical Impact
A local user able to load BPF programs can trigger a kernel use-after-free, risking memory corruption, denial of service, or privilege escalation on hosts using IPv6 segment routing.

Affected Products

Linux kernel builds compiled with CONFIG_IPV6_SEG6_BPF and BPF LWT support
Stable kernel branches referenced by the fix commits (0f38472, 37b1868, 9f9e57b, b9bb0e7, cae8674, df0072b, e4a6283, fca71ea)
Distributions shipping unpatched kernels that expose LWT_SEG6LOCAL BPF program loading

Discovery Timeline

2026-10-09 - CVE-2026-98383 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98383

Vulnerability Analysis

IPv6 Segment Routing (SRv6) allows BPF programs attached as LWT_SEG6LOCAL to inspect and modify the Segment Routing Header on packets traversing lightweight tunnels. To accelerate access, the kernel caches a pointer to the SRH in per-CPU state and later validates the header after the BPF program returns.

The helper bpf_lwt_seg6_adjust_srh() can invalidate that cached pointer when it mutates the SRH. If the same program then calls bpf_skb_pull_data(), the socket buffer helper may reallocate skb->head to linearize the requested amount of data. The reallocation frees the original backing memory, and the per-CPU SRH pointer continues to reference the freed region.

When the kernel performs post-program SRH validation, it writes through the dangling pointer. The write targets memory that may already be reused by other kernel allocations, producing a kernel use-after-free [CWE-416] with controllable side effects.

Root Cause

The root cause is a missing verifier restriction. The BPF verifier permitted the combination of bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data() within the same LWT_SEG6LOCAL program despite incompatible lifetime assumptions between the two helpers. No runtime check reconciled the cached SRH pointer with potential skb->head reallocation.

Attack Vector

Exploitation requires the ability to load BPF programs attached as LWT_SEG6LOCAL, which generally demands CAP_BPF or CAP_NET_ADMIN within the initial user namespace. A local attacker crafts a program that first calls bpf_lwt_seg6_adjust_srh() to invalidate the cached SRH, then calls bpf_skb_pull_data() with a length that forces skb linearization and head reallocation. The subsequent kernel-side SRH validation triggers the out-of-bounds write.

No verified public proof-of-concept has been published. See the referenced Linux kernel commits for the authoritative description of the unsafe helper interaction.

Detection Methods for CVE-2026-98383

Indicators of Compromise

Kernel oops, general protection fault, or KASAN use-after-free report referencing seg6_bpf_srh_state, bpf_lwt_seg6_adjust_srh, or bpf_skb_pull_data
Unexpected kernel panics on IPv6 routers or segment routing endpoints shortly after BPF program loads
bpf() syscall activity from non-administrative service accounts attaching LWT_SEG6LOCAL programs

Detection Strategies

Audit bpf() syscalls with program type BPF_PROG_TYPE_LWT_SEG6LOCAL and alert on loads from unexpected processes or users
Correlate kernel ring-buffer messages containing seg6 or BUG: KASAN with recent BPF loader activity
Inventory kernel versions across Linux fleets and flag hosts missing the fix commits listed in the Patch Information section

Monitoring Recommendations

Enable kernel audit rules for the bpf syscall and forward events to a centralized log platform
Collect dmesg and /var/log/kern.log from IPv6 edge nodes to catch use-after-free signatures
Track package versions through configuration management to confirm patched kernels are deployed and booted

How to Mitigate CVE-2026-98383

Immediate Actions Required

Apply the stable kernel update that includes the verifier restriction and reboot affected hosts
Restrict CAP_BPF and CAP_NET_ADMIN to trusted administrators and remove unnecessary BPF loader privileges from service accounts
Set kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF

Patch Information

The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs at verifier load time. Apply the kernel update that contains the relevant stable commit for your branch: 0f38472, 37b1868, 9f9e57b, b9bb0e7, cae8674, df0072b, e4a6283, or fca71ea. Consult your distribution's security advisory for the matching backported package.

Workarounds

Disable IPv6 Segment Routing BPF support by building kernels without CONFIG_IPV6_SEG6_BPF where SRv6 BPF is not required
Prevent attachment of LWT_SEG6LOCAL programs by removing CAP_NET_ADMIN from workloads that do not manage routing
Deny bpf() syscall access using seccomp profiles or SELinux policies on container workloads that have no legitimate BPF use case

bash

# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf

# Verify running kernel version against distribution advisory
uname -r