Executive brief
The Linux kernel's IPv6 SRv6 routing implementation fails to properly reset internal state after decapsulating packets, allowing an unprivileged user to craft malicious packets that trigger an out-of-bounds memory read. This can cause kernel crashes or potentially allow an attacker to read sensitive kernel memory, impacting system availability and security.
Technical details
A buffer over-read vulnerability exists in the Linux kernel's SRv6 (Segment Routing for IPv6) implementation within the decap_and_validate() function. When processing End.DT6 routes, the IPv6 control block (IP6CB) is not properly reset after decapsulating outer SRv6 headers. This leaves stale offset values (nhoff) and extension-header flags from the outer packet intact. When the inner IPv6 packet is processed by ip6_protocol_deliver_rcu(), it uses the incorrect nhoff value on the inner packet, causing it to read beyond the skb head boundary. An unprivileged user can trigger this by injecting a crafted packet containing Hop-by-Hop and Destination Options headers followed by an SRH and minimal inner IPv6 packet. The fix involves clearing IP6CB after decapsulation while preserving the incoming interface index and L3 slave state, and resetting nhoff to point to the inner IPv6 base-header nexthdr field.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-11: disclosed