In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA… (CVE-2026-98802)

The Linux kernel's seg6 implementation had a vulnerability where advance_nextseg() and seg6_next_csid_advance_arg() functions modified the SRH Segments Left field and IPv6 destination address without verifying that the packet data was writable. This oversight allowed modifications to shared packet data in cloned skbs, such as those cloned by AF_PACKET sockets on ingress devices, potentially causing the socket to receive modified packets instead of the original ones. The patch adds calls to skb_ensure_writable() before any modification, which may reallocate packet data and invalidate pointers. On failure to ensure writability, the packet is dropped with SKB_DROP_REASON_NOMEM.

The vulnerability could cause packet data shared with cloned sockets to be unintentionally modified, leading to potential data integrity issues in network packet processing. This may affect applications relying on AF_PACKET sockets by delivering altered packets. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix is available that adds calls to skb_ensure_writable() in advance_nextseg() and seg6_next_csid_advance_arg() to ensure packet data is writable before modification. On failure, packets are dropped to prevent data corruption. Users should apply the official Linux kernel patch that addresses this issue. No additional mitigation steps are indicated by the vendor advisory.