« Volver al listado

CVE-2026-98383

Estado: RecibidaSin puntuar—

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:

bpf: Desautorizar bpf_skb_pull_data() para LWT_SEG6LOCAL

Un programa LWT_SEG6LOCAL puede invalidar su SRH en caché con bpf_lwt_seg6_adjust_srh() y luego llamar a bpf_skb_pull_data(). Esta última puede reasignar skb->head, dejando el puntero SRH por CPU colgante. La validación de SRH posterior al programa escribe entonces a través de ese puntero.

Se desautoriza bpf_skb_pull_data() para programas LWT_SEG6LOCAL para que el verificador rechace esta combinación de helpers insegura. Otros tipos de programas LWT continúan exponiendo el helper a través de lwt_out_func_proto().

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98383",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "b9bb0e735460751b620156f800a4279a28573392",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
              "lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/core/filter.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/core/filter.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-09T08:16:56.800",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."
    }
  ],
  "lastModified": "2026-10-09T08:16:56.800",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}