SB2026092896 - Out-of-bounds write in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98096)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to improper network header offset restoration in the Linux kernel ipv6_srh_rcv() function when processing IPv6 Segment Routing Header packets preceded by another extension header. A remote attacker can send a specially crafted IPv6 packet to cause memory corruption or a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3ad7dca5e03bd64c65983a19734337512fd75491
• https://git.kernel.org/stable/c/975b5b067f525a1b1338c4a3bee1c46545801518
• https://git.kernel.org/stable/c/97b21ef57dfabbff660a4672c9fef7edfb720f47
• https://git.kernel.org/stable/c/ce4c8beedc19aceeab0e7bdc6f34394fb158c47c