CVE-2026-98531 Overview
CVE-2026-98531 is an out-of-bounds read vulnerability in the Linux kernel's IPv6 Segment Routing (SR) subsystem. The flaw resides in seg6_genl_policy, where the SEG6_ATTR_DST netlink attribute is defined with .type = NLA_BINARY and .len = sizeof(struct in6_addr). Because NLA_BINARY only enforces a maximum payload length, shorter attributes pass validation. When seg6_genl_set_tunsrc() performs kmemdup(val, sizeof(*val), GFP_KERNEL), a short attribute causes a 16-byte read past skb->tail into uninitialized skb->head memory. The leaked data is stored in sdata->tun_src and returned to userspace through SEG6_CMD_GET_TUNSRC.
Critical Impact
An unprivileged local attacker with the ability to send generic netlink messages can leak 16 bytes of uninitialized kernel heap memory per request, defeating KASLR and exposing sensitive kernel state.
Affected Products
- Linux kernel IPv6 Segment Routing (ipv6/sr) subsystem
- Linux kernel 7.3.0-rc3 confirmed vulnerable in reporter testing
- Multiple stable branches referenced by the git commits listed in the fix set
Discovery Timeline
- 2026-10-18 - CVE-2026-98531 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98531
Vulnerability Analysis
The vulnerability is an [Out-of-Bounds Read] in the IPv6 Segment Routing generic netlink handler. The seg6_genl_policy table declares SEG6_ATTR_DST using NLA_BINARY with a .len field set to sizeof(struct in6_addr) (16 bytes). Netlink validation treats NLA_BINARY.len values as an upper bound, not a strict length, so a payload of 0 to 15 bytes is accepted without error.
When seg6_genl_set_tunsrc() processes the attribute, it unconditionally duplicates 16 bytes starting at the attribute payload pointer using kmemdup(val, sizeof(*val), GFP_KERNEL). If the actual attribute payload is shorter, kmemdup reads past skb->tail into adjacent uninitialized memory within the socket buffer's skb->head region. The copied bytes are stored in sdata->tun_src and later returned to any caller issuing SEG6_CMD_GET_TUNSRC.
Testing under QEMU showed tun_src populated with uninitialized heap bytes such as 836a61ecc4d25a1042a8d60411cfb378 after a crafted 0-byte attribute request.
Root Cause
The root cause is incorrect use of NLA_BINARY for a fixed-length attribute. NLA_BINARY provides a maximum-length check only, while the consumer code assumes an exact-length payload. This mismatch between validation semantics and consumer expectations produces the out-of-bounds read.
Attack Vector
A local user able to open a generic netlink socket and send SEG6_CMD_SET_TUNSRC with a truncated SEG6_ATTR_DST attribute triggers the read. Issuing SEG6_CMD_GET_TUNSRC returns the leaked 16 bytes of uninitialized kernel memory to userspace. Repeated calls can harvest kernel pointers or secrets useful for defeating KASLR or chaining with other vulnerabilities. See the upstream commits in the kernel.org stable tree for the exact patch logic.
Detection Methods for CVE-2026-98531
Indicators of Compromise
- Unexpected userspace processes issuing SEG6_CMD_SET_TUNSRC or SEG6_CMD_GET_TUNSRC generic netlink commands outside of normal network configuration tooling.
- Kernel log entries referencing netlink policy failures with -ERANGE (-34) after the patch is applied, indicating prior exploitation attempts.
Detection Strategies
- Audit generic netlink traffic to the SEG6 family and alert on SEG6_ATTR_DST attributes shorter than 16 bytes.
- Enable kernel sanitizers (KASAN) in test environments to catch the out-of-bounds read during fuzzing or regression testing.
- Correlate SEG6_CMD_SET_TUNSRC followed by rapid SEG6_CMD_GET_TUNSRC calls from the same process as a probable info-leak pattern.
Monitoring Recommendations
- Monitor unprivileged processes making netlink NETLINK_GENERIC syscalls that reference the SEG6 family.
- Track kernel version inventory across Linux hosts to identify systems running vulnerable builds.
- Forward auditd netlink and syscall events to a centralized data lake for retroactive hunting once IOCs become available.
How to Mitigate CVE-2026-98531
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the fix commit set and reboot affected systems.
- Restrict access to generic netlink sockets by limiting which users and containers can issue SEG6 commands.
- Inventory kernel versions across the fleet and prioritize patching for multi-tenant hosts where local info leaks have the greatest impact.
Patch Information
The fix replaces NLA_BINARY with NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) for SEG6_ATTR_DST in seg6_genl_policy. Generic netlink validation then rejects any attribute whose length is not exactly 16 bytes with -ERANGE. Patches are available in the following commits: 050a0aa3, 195813bb, 209eefeb, 2d959c7, 66bf65fa, 6fcfc362, 94214cf0, and e3ac68c1.
Workarounds
- Where IPv6 Segment Routing is not required, disable the ipv6_sr functionality via sysctl (net.ipv6.conf.all.seg6_enabled=0) and avoid loading related modules.
- Use seccomp or Linux Security Modules (SELinux, AppArmor) to block unprivileged processes from sending generic netlink messages to the SEG6 family.
- Deny CAP_NET_ADMIN in untrusted container runtimes to reduce the attack surface for netlink-based info leaks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
