CVE-2026-72400
CVE CVE-2026-72400EUVD EUVD-2026-59299Published 2026-08-15T05:56:25.000ZLast changed 2026-08-17T05:43:42.000ZCVSS 7.8
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6_validate_srh() reads fixed SRH fields such as srh->type and srh->hdrlen before checking that the supplied length covers the fixed struct ipv6_sr_hdr fields. The BPF SEG6 encap path reaches this with a BPF program-supplied pointer and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6 encap header can therefore make the validator read srh->type at offset 2 beyond the caller-supplied buffer. Reject lengths shorter than the fixed SRH at the top of seg6_validate_srh(), before any field is read. This fixes the BPF helper path and keeps the common validator robust.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <c9961336aa5ff83092f23e33ee86666a9dbd1b2a; patch: 5.10.261; patch: 6.6.145; patch: 6.12.97; patch: 7.2; patch: 5.15.212; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <071f1a38d7ddbadee29c09b9e3ee0ff3a61e6a0e; patch: 7.1.5; patch: 6.1.178; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <0fc7069d39239978130c37ebceaec85c8948d3f1; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <7247d05c987c3eec4bb7c2306dbd77ecdf3b7c73; 4.18; patch: 6.18.40; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <715eb12e453df752f1b4baaf972c3acff0ab9402; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <804bb969f194c93497ba632b98343794c6367fdc; patch: 0; fe94cc290f535709d3c5ebd1e472dfd0aec7ee79 <8dba7a94a269b88e500aafc25ad567ef6a423698
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.