In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit… (CVE-2026-98934)

The Linux kernel vulnerability CVE-2026-98934 involves the IPv6 segment routing (SR) code, specifically in the seg6_make_flowlabel() function. The problem was that __skb_flow_dissect(), which requires a network namespace pointer, could be called with an skb that had neither skb->dev nor skb->sk set, leading to potential incorrect behavior. This situation was reproducible with a TIPC UDP bearer sending discovery messages through an IPv4 route using seg6 encapsulation when net.ipv6.seg6_flowlabel was enabled. The fix involved modifying seg6_make_flowlabel() to use skb_get_hash_net(), which safely obtains the network namespace pointer from the skb, preventing the issue.

The vulnerability could cause incorrect handling of network packets in the IPv6 segment routing code when certain skb pointers are missing, potentially leading to kernel errors or unexpected behavior in network packet processing. No known exploits in the wild have been reported, and the impact is limited to specific network configurations involving TIPC UDP and seg6 encapsulation.

A fix has been implemented in the Linux kernel source code to address this issue by using skb_get_hash_net() in seg6_make_flowlabel(). Users should update their Linux kernel to a version that includes this commit to remediate the vulnerability. Since no specific patched versions are provided, check the vendor or kernel source repository for the commit d58e468b1112 and subsequent fixes related to seg6_make_flowlabel().