Routing cache isolation flaw in Linux kernel seg6 lwtunnel (CVE-2026-31668)

The seg6 lwtunnel in the Linux kernel shares a single dst_cache between the seg6_input_core() and seg6_output_core() paths. Because these paths can perform post-encapsulation SID lookups under different routing contexts (such as VRF tables or ingress-interface ip rules), whichever path runs first populates the cache and the other reuses it blindly, bypassing its own lookup. An attacker could possibly exploit this to compromise the system. Affected versions: - Ubuntu 25.10 We recommend updating to: linux-image-6.17.0-1018-oracle-64k 6.17.0-1018.18, linux-image-6.17.0-1019-aws 6.17.0-1019.19, linux-image-6.17.0-1019-aws-64k 6.17.0-1019.19, linux-image-6.17.0-1020-gcp 6.17.0-1020.22, linux-image-6.17.0-1020-gcp-64k 6.17.0-1020.22, linux-image-6.17.0-40-generic 6.17.0-40.40. CVSS 9.8 · our assessment: act_now Reference: https://ubuntu.com/security/notices/USN-8490-1 Details: https://vuln.today/cve/CVE-2026-31668