Executive brief
The Linux kernel's IPv6 Segment Routing (seg6) implementation fails to properly clear control block data when decapsulating IPv4 packets, allowing stale IPv6 metadata to be interpreted as IPv4 options. An attacker can craft a malicious IPv6 packet with crafted extension headers to trigger a buffer overflow during TCP SYN handling, potentially causing kernel crashes or code execution on affected systems.
Technical details
This is a control block (CB) corruption vulnerability in the Linux kernel's IPv6 Segment Routing (seg6) implementation. The End.DX4 and End.DT4 routing functions decapsulate IPv4 packets using decap_and_validate() and route them directly without clearing the IPv6 control block (IP6CB) data. Since IP6CB and IPv4 control block (IPCB) share the same skb->cb storage, the stale IPv6 data overlaps with IPv4 option parsing fields. An attacker can construct an IPv6 packet with a Destination Options header followed by a Segment Routing Header, setting sender-controlled values that corrupt the IPv4 optlen field. When the inner packet reaches TCP processing, __ip_options_echo() reads beyond its allocated buffer based on the corrupted optlen value, causing a slab-out-of-bounds write detected by KASAN. The vulnerability requires network-reachable IPv6 routing but does not require authentication. The fix involves clearing IPCB in the common decapsulation path while preserving the ingress interface identifier.
Affected products
- Linux Linux kernel v7.2-rc5 and likely earlier; vulnerability date suggests recent detection but may affect multiple stable branches
Timeline
- 2026-09-04: disclosed