In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST In seg6_genl_policy,… (CVE-2026-98531)

The Linux kernel's seg6_genl_policy defined SEG6_ATTR_DST with a type allowing variable length payloads, permitting shorter-than-expected attributes. When seg6_genl_set_tunsrc() copied data assuming a fixed size, a short attribute caused a 16-byte out-of-bounds read into uninitialized kernel memory. This memory was then leaked back to userspace via the SEG6_CMD_GET_TUNSRC command. The fix replaced the attribute policy with NLA_POLICY_EXACT_LEN to enforce exact length validation, causing malformed messages to be rejected with an error.

An attacker able to send crafted Generic Netlink messages could cause the kernel to leak 16 bytes of uninitialized kernel heap memory to userspace. This information disclosure could potentially aid further attacks or information gathering. No evidence of active exploitation is known.

A patch is available that enforces exact length validation on the SEG6_ATTR_DST attribute, rejecting malformed netlink messages and preventing the memory leak. Users should update to a Linux kernel version that includes this fix. No additional mitigations are indicated.