seg6: separate dst_cache for input and output paths in seg6 lwtunnel (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.44 % · percentile 38 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup. Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.
Weaknesses (CWE)
- CWE-459 — Incomplete Cleanup
References
- https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449
- https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf
- https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9
- https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1
- https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c
- https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1
- https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a
- https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-25561
- GCVE · GCVE-0-2026-31668
CERT-FR advisories
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1117 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1027 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0898 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0861 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0831 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0782 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0697 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0696 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0547 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0526 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10.1 < 5.10.253cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.203cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.169cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.135cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.82cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.23cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.13cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 6c8702c60b88651072460f3f4026c7dfe2521d12 < 1dec91d3b1cefb82635761b7812154af3ef46449 ; affected 6c8702c60b88651072460f3f4026c7dfe2521d12 < 750569d6987a0ff46317a4b86eb3907e296287bf ; affected 6c8702c60b88651072460f3f4026c7dfe2521d12 < 57d0374d14fa667dec6952173b93e7e84486d5c9 ; affected 6c8702c60b88651072460f3f4026c7dfe2521d12 < 84d458018b147176b259347103fccb7e93abd2b1 ; affected 6c8702c60b88651072460f3f4026c7dfe2521d12 < 6305ad032b03d2ea4181b953a66e19a9a6ed053c ; affected 6c8702c60b88651072460f3f4026c7dfe2521d12 < fb56de5d99218de49d5d43ef3a99e062ecd0f9a1 |
| Linux · Linux | affected 4.10 ; unaffected 0 < 4.10 ; unaffected 5.10.253 ≤ 5.10.* ; unaffected 5.15.203 ≤ 5.15.* ; unaffected 6.1.169 ≤ 6.1.* ; unaffected 6.6.135 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |