Is there a patch available for CVE-2026-98531?

Yes, a patch is available for CVE-2026-98531. Update the affected software to the latest version immediately.

Linux CVE-2026-98531

EUVD-2026-103576

2026-10-18 Linux

GHSA-365h-h8v6-r47m

Buffer Overflow Linux

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives.

Patch available

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In seg6_genl_policy, SEG6_ATTR_DST is defined with .type = NLA_BINARY and .len = sizeof(struct in6_addr). For NLA_BINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6_genl_set_tunsrc() copies sizeof(struct in6_addr) bytes via kmemdup(val, sizeof(*val), GFP_KERNEL), a short SEG6_ATTR_DST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tun_src and leaked back to userspace via SEG6_CMD_GET_TUNSRC.

Switch SEG6_ATTR_DST in seg6_genl_policy to NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6_addr) with -ERANGE.

Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6_CMD_SET_TUNSRC Generic Netlink message with a 0-byte SEG6_ATTR_DST attribute followed by SEG6_CMD_GET_TUNSRC. On the unfixed kernel, SEG6_CMD_SET_TUNSRC succeeds (err = 0) and SEG6_CMD_GET_TUNSRC leaks 16 bytes of uninitialized kernel heap memory (tun_src = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6_CMD_SET_TUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tun_src remains zeroed.

Affected VersionsENISA

Linux patch: 6.18.55

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <2d959c75c27f90e9ec489d18ce5ee6b852ad4741

Linux patch: 6.6.158

Linux patch: 5.10.271

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <195813bb7324c338eaba0aaa02b18681ee65b670

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <e3ac68c1cdc2535d127b2bfd50c263d16c8e4199

Linux patch: 6.12.112

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <66bf65fa109326e4c4ddeb0b94093379f72838fd

Linux 4.10

Linux patch: 7.2.9

Linux patch: 7.3-rc5

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <6fcfc362344edea745a69f3a705de50b731f3418

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <050a0aa3c80907b8c60a396b7e04d48d8b1a9e70

Linux patch: 6.1.189

Linux patch: 5.15.222

Linux patch: 0

Linux 915d7e5e5930b4f01d0971d93b9b25ed17d221aa <209eefebee54c4a5f01d68b61e8ac9881eca2de9

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 18, 2026 - 16:02 EUVD

CVE Published

Oct 18, 2026 - 15:17 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

Data Quality

1 sources

Confidence: Low

EUVD

CVE.org

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS N/A

Patch available Yes

Active threat No

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives.

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.