Is there a patch available for CVE-2026-98306?

Yes, a patch is available for CVE-2026-98306. Update the affected software to the latest version immediately.

Linux CVE-2026-98306

EUVD-2026-93291

2026-10-06 Linux

GHSA-8vq5-3gc9-33qh

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

When an SRv6 packet arrives on an interface enslaved to a VRF, vrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate() has never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the common case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of a reassembled outer packet could even set it, with no VRF involved. Commit 44930446dde4 ("ipv6: seg6: clear IPv4 control block on IPIP decapsulation") then made the unreliable bit reliably clear.

The effect of the missing flag is visible with End.DX4 when a delivery to a local address of the node reaches the socket lookup. For example, a UDP socket bound to the enslaved ingress interface does not receive any of the decapsulated packets, while an unbound socket outside the VRF does. This contradicts Documentation/networking/vrf.rst: by default the scope of an unbound UDP or TCP socket is limited to the default VRF.

Set IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does the same for IPv6. The socket lookup then matches the decapsulated packet like any other packet received on that enslaved interface. Such a packet matches an unbound UDP or TCP socket only when udp_l3mdev_accept or tcp_l3mdev_accept is set.

Affected VersionsENISA

Linux patch: 5.10.271

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <e4d7c52f15f572608374947c6c802052e1a2fc82

Linux 4.14

Linux patch: 6.18.54

Linux patch: 5.15.222

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <1d9f5c78903dd25a3556229eb716dd465c5f3573

Linux patch: 0

Linux patch: 6.12.112

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <f8fb4738ccef5f9d107845b05734a56352747b1a

Linux patch: 6.6.158

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <5130afa025c95faa621adf8bac525baeb2b290d2

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <72f410616000d21a0a6ec6c93a60301b9c92e95c

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <ddf60220c925b54a1714c4722fdbdb12833232d0

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d

Linux patch: 6.1.189

Linux patch: 7.3-rc4

Linux 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 <7616242a2b37883f7322aaa1d2bd6cd0fed28315

Linux patch: 7.2.8

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:46 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.