Use-after-free in Linux kernel - CVE-2026-98383
Published: October 9, 2026
Vulnerability identifier: #VU154046
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98383
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to use-after-free in BPF LWT_SEG6LOCAL handling when performing post-program SRH validation. A local user can run an LWT_SEG6LOCAL program that invalidates its cached SRH with bpf_lwt_seg6_adjust_srh() and then calls bpf_skb_pull_data() to corrupt kernel memory.
Reallocation of skb->head leaves the per-CPU SRH pointer dangling, and subsequent SRH validation writes through that pointer.
Affected software
Linux kernel
How to mitigate CVE-2026-98383
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32
- https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5
- https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb
- https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392
- https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f
- https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf
- https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5
- https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1