SB20261022416 - Modification of assumed-immutable data in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Modification of assumed-immutable data (CVE-ID: CVE-2026-98802)

CWE-ID: CWE-471 - Modification of Assumed-Immutable Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the integrity of packet data delivered to packet sockets.

The vulnerability exists due to modification of shared packet data without ensuring writability in the advance_nextseg() and seg6_next_csid_advance_arg() functions when processing IPv6 segment routing packets. A remote attacker can send packets that undergo segment routing processing while their data is shared with a clone queued to an AF_PACKET socket to cause socket readers to receive modified packet contents instead of the originally received contents.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8ae3f4067ba4ae3a15581392f6dac422e3d3def0
• https://git.kernel.org/stable/c/e9141fdb7a2ead48cfcd60c681aba91d3014255b