Linux Kernel CVE-2026-98096

Requires the target kernel to be built with SRv6 support (CONFIG_IPV6_SEG6) and configured to act as a Segment Routing endpoint that processes an SRH with segments_left > 0. The trigger is a crafted IPv6 packet in which the SRH is preceded by another extension header (such as a Hop-by-Hop options header), so that skb_network_offset() stays negative; exploitation manifests when the packet is routed via ip6_route_input (breaking BPF/C flow dissection) or forwarded via ip6_forward / redirected via act_mirred (negative offset used as unsigned length in sch_fragment or neighbour output → OOB memcpy). Limiting factors: SRv6 endpoint processing is not enabled by default and is rare outside telco/datacenter deployments, and the packet must be specifically structured (AC:H), though no authentication or user interaction is needed.

This is a genuinely network-facing memory-safety bug, unlike the many local-only Linux kernel flaws mislabeled as network-exploitable. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, base 7.4) is largely defensible here: an off-path attacker can send a crafted IPv6 packet carrying a Segment Routing Header (SRH) preceded by another extension header (e.g., Hop-by-Hop options) to a host acting as an SRv6 segment endpoint, so AV:N/PR:N/UI:N hold, and AC:H reflects the requirement that SRv6 processing be configured and the packet be specifically structured. C:N is correct - the description details OOB memcpy / buffer overflow and broken flow dissection, i.e. corruption and crash, not information disclosure; I would temper NVD's I:H toward I:L since the primary observed effect is a crash/DoS from passing a negative offset as an unsigned length, though controlled corruption is plausible. No EPSS score, no CISA KEV entry, and no public exploit are present in the input, so this is not evidence of active exploitation. The dominant limiting factor is deployment: SRv6 segment-endpoint processing is a niche telco/datacenter feature rarely enabled on general-purpose systems, which sharply narrows the real-world attack surface despite the network vector. Net assessment: a real, verify-and-patch-if-you-run-SRv6 issue rather than a broad emergency.

A host is configured as an SRv6 segment endpoint (CONFIG_IPV6_SEG6, processing SRH with segments_left > 0). A remote attacker sends an IPv6 packet whose SRH is preceded by a Hop-by-Hop options header, causing skb_network_offset() to remain negative; when the packet is routed and forwarded (ip6_forward or act_mirred redirect), the negative offset is treated as an unsigned length, triggering an out-of-bounds memcpy that corrupts memory or crashes the kernel. No public proof-of-concept is identified at time of analysis, and the AC:H rating reflects the required SRv6 configuration and precise packet layout.