Not yet scoredPublished Oct 23, 2026

CVE-2026-98934ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

Updated under an hour ago (Oct 27, 2026, 4:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") a caller provided pointer. syzbot was able to reach seg6_make_flowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6_flowlabel is set to 1. seg6_make_flowlabel() already has a net pointer, use skb_get_hash_net(). WARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930 Call trace: __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P) __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903 skb_get_hash include/linux/skbuff.h:1663 [inline] seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132 __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161 seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431 seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681 seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744 lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356 dst_output include/net/dst.h:470 [inline] ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131 iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97 udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187 tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202 tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274 tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576 tipc_enable_bearer net/tipc/bearer.c:366 [inline] __tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048 tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057 genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 23, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3; from d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 8fe3d6717f5536793727e60b7a0b7ec20c697def; from d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 53b21bc2df6e8ed538bceda93a5104a5fe6a8a84; from d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 086e8acb3a0e55f6d22d29fae2a4a3b1561bb766; from d58e468b1112dcd1d5193c0a89ff9f98b5a3e8b9 before 8ec454dcd00ce3375119111c6394964455b36d0d	CNA record

References

References

https://git.kernel.org/stable/c/4ab37e4f4a33c64d9e565dc8c4c3ed774f05c0e3
https://git.kernel.org/stable/c/8fe3d6717f5536793727e60b7a0b7ec20c697def
https://git.kernel.org/stable/c/53b21bc2df6e8ed538bceda93a5104a5fe6a8a84
https://git.kernel.org/stable/c/086e8acb3a0e55f6d22d29fae2a4a3b1561bb766
https://git.kernel.org/stable/c/8ec454dcd00ce3375119111c6394964455b36d0d

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.