Linux Kernel CVE-2026-72400

The affected code resides in the Linux kernel's SEG6 subsystem, specifically seg6_validate_srh() in net/ipv6/seg6.c, which validates IPv6 Segment Routing Headers (SRH) as defined by RFC 8754. The function dereferences struct ipv6_sr_hdr fields - including srh->type and srh->hdrlen - before performing a minimum-size bounds check on the caller-supplied buffer. The BPF-facing attack surface is reached through bpf_lwt_push_encap() for lightweight tunnel (LWT) encapsulation and the SEG6 local BPF actions END_B6 and END_B6_ENCAP; all three funnel into bpf_push_seg6_encap(), which forwards attacker-controlled pointer and length directly to seg6_validate_srh() without a size guard. A buffer as small as 2 bytes causes the validator to read srh->type at offset 2 beyond the end of the supplied buffer, constituting a heap out-of-bounds read in kernel space. The CWE is listed as N/A in source data, but the root cause maps to CWE-125 (Out-of-bounds Read). The vulnerability was introduced at commit fe94cc290f535709d3c5ebd1e472dfd0aec7ee79, corresponding to the addition of SRv6 BPF helper support in kernel 4.18. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.