Executive brief
The Linux kernel's SEG6 (IPv6 Segment Routing) module contains a buffer over-read vulnerability in the SRH (Segment Routing Header) validation function. When BPF programs supply a short encapsulation header (as short as 2 bytes), the validator attempts to read fixed header fields before checking the buffer length, allowing reads beyond the supplied buffer boundary. An attacker can exploit this via BPF helper functions to trigger a kernel information leak or denial of service.
Technical details
The vulnerability is a classic buffer over-read flaw in the seg6_validate_srh() function located in net/ipv6/seg6.c. The function reads fixed fields from the ipv6_sr_hdr structure (srh->type and srh->hdrlen at offsets 1 and 2 respectively) before validating that the supplied length parameter covers the minimum size of the structure. The BPF SEG6 encap path, specifically bpf_lwt_push_encap() and the END_B6/END_B6_ENCAP BPF actions via bpf_push_seg6_encap(), forwards BPF program-supplied length values directly without a minimum-size guard. A malicious or buggy BPF program can pass a length of 2 bytes, causing the validator to read beyond the caller-supplied buffer. The fix adds a check at the start of seg6_validate_srh() to reject lengths smaller than sizeof(struct ipv6_sr_hdr) before any field access occurs. The patch is available and has been backported to stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions prior to the fix commit a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa
Timeline
- 2026-08-15: disclosed: CVE-2026-72400 published
- 2026-06-23: patched: Fix commit a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa authored; backported to stable branches