CVE-2026-98383

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer. Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwt_out_func_proto().

Is your site exposed to CVE-2026-98383?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0016

Probability of exploitation

0.05%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32 https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5 https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392 https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5 https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1

Frequently Asked Questions

What is CVE-2026-98383? +

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer. Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwt_out_func_proto().

How do I check if I'm vulnerable to CVE-2026-98383? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.