{
  "cveId": "CVE-2026-98802",
  "url": "https://patchblox.com/security/cve/CVE-2026-98802",
  "summary": "CVE-2026-98802 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98802 (version 7.2.10-1), released October 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "seg6: ensure packet data is writable before modifying SRH and IPv6 DA",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  seg6: ensure packet data is writable before modifying SRH and IPv6 DA  advance_nextseg() modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6_next_csid_advance_arg() has the same problem when it advances the NEXT-C-SID argument in the destination address.  The skb may be cloned, for example by an AF_PACKET socket receiving on the ingress device. advance_nextseg() and seg6_next_csid_advance_arg() then write into the packet data shared with the clone. A read from that socket can return the modified packet instead of the received one. The simplified path below shows this for advance_nextseg():  __netif_receive_skb_one_core   __netif_receive_skb_core     deliver_skb               [orig: users=2, cloned=0]       packet_rcv         skb_clone             clone queued to the AF_PACKET socket         consume_skb(orig)     [orig: users=1, cloned=1]   ipv6_rcv     ip6_rcv_core              skb_share_check: no-op [orig: users=1]     [...]       input_action_end_core         advance_nextseg       writes into the data shared with the clone  Call skb_ensure_writable() in advance_nextseg() and in seg6_next_csid_advance_arg() before they modify the packet data. skb_ensure_writable() may reallocate skb-\u003Ehead, which invalidates the pointers into the packet data taken before the call. advance_nextseg() now returns a valid SRH pointer, or NULL if skb_ensure_writable() fails. seg6_next_csid_advance_arg() takes the pointer to the destination address from the skb after skb_ensure_writable(). On failure, the callers drop the packet with SKB_DROP_REASON_NOMEM.",
  "published": "2026-10-18T16:17:34Z",
  "severity": "Low",
  "cvss": 3.7,
  "epss": 0.00155,
  "epssPercentile": 0.0469,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98802",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.10-1",
      "fix": "DEBIAN-CVE-2026-98802",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98802",
      "released": "2026-10-19T16:27:52Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}