Improper access control in Linux kernel - CVE-2026-98306

Vulnerability details

The vulnerability allows a remote attacker to bypass VRF socket isolation.

The vulnerability exists due to improper access control caused by failure to propagate the VRF interface flag in decap_and_validate() in net/ipv6/seg6_local.c when decapsulating IPv4 traffic from SRv6 packets received on VRF-enslaved interfaces. A remote attacker can send SRv6 packets carrying IPv4 traffic that is delivered to an unbound socket outside the ingress VRF to bypass VRF socket isolation.

The behavior is observable with the End.DX4 action during delivery to a local address of the node.

Affected software

How to mitigate CVE-2026-98306

External References

• https://git.kernel.org/stable/c/1d9f5c78903dd25a3556229eb716dd465c5f3573
• https://git.kernel.org/stable/c/5130afa025c95faa621adf8bac525baeb2b290d2
• https://git.kernel.org/stable/c/72f410616000d21a0a6ec6c93a60301b9c92e95c
• https://git.kernel.org/stable/c/7616242a2b37883f7322aaa1d2bd6cd0fed28315
• https://git.kernel.org/stable/c/8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d
• https://git.kernel.org/stable/c/ddf60220c925b54a1714c4722fdbdb12833232d0
• https://git.kernel.org/stable/c/e4d7c52f15f572608374947c6c802052e1a2fc82
• https://git.kernel.org/stable/c/f8fb4738ccef5f9d107845b05734a56352747b1a

Related Security Bulletins

• Improper access control in Linux kernel ipv6
• Debian update for linux