FKIE_CVE-2026-72400

Vulnerability from fkie_nvd - Published: 2026-08-15 06:22 - Updated: 2026-08-17 06:19
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6_validate_srh() reads fixed SRH fields such as srh->type and srh->hdrlen before checking that the supplied length covers the fixed struct ipv6_sr_hdr fields. The BPF SEG6 encap path reaches this with a BPF program-supplied pointer and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6 encap header can therefore make the validator read srh->type at offset 2 beyond the caller-supplied buffer. Reject lengths shorter than the fixed SRH at the top of seg6_validate_srh(), before any field is read. This fixes the BPF helper path and keeps the common validator robust.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0fc7069d39239978130c37ebceaec85c8948d3f1
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/715eb12e453df752f1b4baaf972c3acff0ab9402
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/804bb969f194c93497ba632b98343794c6367fdc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8dba7a94a269b88e500aafc25ad567ef6a423698
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9961336aa5ff83092f23e33ee86666a9dbd1b2a
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/seg6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "715eb12e453df752f1b4baaf972c3acff0ab9402",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "804bb969f194c93497ba632b98343794c6367fdc",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "0fc7069d39239978130c37ebceaec85c8948d3f1",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "8dba7a94a269b88e500aafc25ad567ef6a423698",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "c9961336aa5ff83092f23e33ee86666a9dbd1b2a",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            },
            {
              "lessThan": "a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa",
              "status": "affected",
              "version": "fe94cc290f535709d3c5ebd1e472dfd0aec7ee79",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/seg6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: validate SRH length before reading fixed fields\n\nseg6_validate_srh() reads fixed SRH fields such as srh-\u003etype and\nsrh-\u003ehdrlen before checking that the supplied length covers the fixed\nstruct ipv6_sr_hdr fields.\n\nThe BPF SEG6 encap path reaches this with a BPF program-supplied pointer\nand length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and\nEND_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the\nlength to seg6_validate_srh() with no minimum-size guard.  A 2-byte SEG6\nencap header can therefore make the validator read srh-\u003etype at offset 2\nbeyond the caller-supplied buffer.\n\nReject lengths shorter than the fixed SRH at the top of\nseg6_validate_srh(), before any field is read.  This fixes the BPF helper\npath and keeps the common validator robust."
    }
  ],
  "id": "CVE-2026-72400",
  "lastModified": "2026-08-17T06:19:06.633",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T06:22:13.567",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0fc7069d39239978130c37ebceaec85c8948d3f1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/715eb12e453df752f1b4baaf972c3acff0ab9402"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/804bb969f194c93497ba632b98343794c6367fdc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8dba7a94a269b88e500aafc25ad567ef6a423698"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c9961336aa5ff83092f23e33ee86666a9dbd1b2a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.