Linux Kernel EUVD-2026-95538

Exploitation requires the host to be running an LWT_SEG6LOCAL (IPv6 Segment Routing Header, SRv6) route with an attached BPF program, and the attacker must be able to load/attach such a BPF program and configure the seg6local route - operations normally requiring CAP_NET_ADMIN/CAP_BPF (effectively a local, privileged operation, consistent with AV:L). The specific unsafe sequence is calling bpf_lwt_seg6_adjust_srh() (invalidating the cached SRH) followed by bpf_skb_pull_data() within the same program. Limiting factors: the IPv6 segment-routing / SEG6 LWT feature must be in use (a non-default, niche configuration on most systems); it is not remotely reachable by an unauthenticated network attacker; and the issue is confined to LWT_SEG6LOCAL programs - other LWT program types continue to expose the helper and are not affected by this restriction.

Signals are consistent and point to a genuine-but-bounded local kernel issue rather than a mass-exploitation emergency. The supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) describes local, low-complexity access with some privilege required and high impact to all three of confidentiality, integrity and availability - consistent with a kernel-memory-corruption bug. EPSS is low at 0.16% (5th percentile) and there is no CISA KEV listing and no confirmed public exploit, so there is no evidence of active or imminent widespread exploitation. The vuln.today decision label is 'this_week', which aligns with the low-but-nonzero exploitation probability and the fact that a fix is already shipped. No SSVC fields (exploitation/automatable/technical impact) were supplied, so that framework cannot be evaluated. One tension worth noting for triage: the vector states PR:L, but reaching the vulnerable code path requires the ability to load an LWT_SEG6LOCAL BPF program and configure IPv6 segment-routing (an operation normally gated behind CAP_NET_ADMIN/CAP_BPF), which argues for a higher privilege requirement than PR:L - verify the intended privilege model with the Linux maintainers. The input tags this as 'Information Disclosure', but the description states the kernel writes through a dangling pointer, i.e. memory corruption, not primarily disclosure.

A local actor who can load BPF programs and configure IPv6 segment routing attaches an LWT_SEG6LOCAL program that invalidates its cached SRH via bpf_lwt_seg6_adjust_srh() and then calls bpf_skb_pull_data(); the pull reallocates skb->head and leaves the per-CPU SRH pointer dangling, and post-program SRH validation then writes through that freed pointer, corrupting kernel memory. No public exploit identified at time of analysis; the exact trigger reliability and exploitability beyond the described crash/corruption are not detailed in the available sources.