CVE-2026-98383

Executive Summary

CVE-2026-98383 is a memory-safety defect in the Linux kernel BPF subsystem in which an LWT_SEG6LOCAL program can invalidate its cached SRH (Segment Routing Header) pointer via bpf_lwt_seg6_adjust_srh() and then invoke bpf_skb_pull_data(), which may reallocate skb->head and leave that per-CPU SRH pointer dangling. Because post-program SRH validation subsequently writes through the dangling pointer, an attacker able to load and attach a crafted LWT_SEG6LOCAL BPF program can trigger a write through freed/reallocated memory, constituting a local privilege-escalation and potential kernel-memory-corruption primitive. Systems running affected Linux kernels with CONFIG_LWTUNNEL, CONFIG_IPV6_SEG6_LWTUNNEL, and unprivileged or otherwise reachable BPF program loading are in scope; no public exploit or PoC is currently available.

Technical Analysis

The vulnerability resides in the interaction between two BPF helpers exposed to LWT (Lightweight Tunnel) programs of type LWT_SEG6LOCAL:

1. bpf_lwt_seg6_adjust_srh() — used by LWT_SEG6LOCAL programs to adjust the Segment Routing Header carried on an IPv6 segment-routing packet. Program logic caches a pointer to the SRH that the kernel will use for subsequent validation.
2. bpf_skb_pull_data() — a linearization helper that may cause the skb head to be reallocated, thereby invalidating pointers previously derived from the old skb->head region.

The ADVISORY states: "An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may reallocate skb->head, leaving the per-CPU SRH pointer dangling. Post-program SRH validation then writes through that pointer."

The defect class is therefore a dangling pointer / use-after-reallocation condition combined with uninitialized/unsafe pointer access (CWE-416 / CWE-824). The kernel retains a per-CPU SRH pointer across the helper sequence; because bpf_skb_pull_data() can move the backing packet buffer, the retained pointer no longer references valid, owned memory. When the kernel performs SRH validation after the LWT program returns, it writes through this stale pointer.

The fix is a verifier-side restriction: "Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier rejects this unsafe helper combination. Other LWT program types continue to expose the helper through lwt_out_func_proto()." This confirms the flaw is not in bpf_skb_pull_data() itself but in the helper allow-list presented to LWT_SEG6LOCAL programs, which permitted an unsafe sequence of operations.

Attack surface characteristics:

• Local attack vector: loading BPF programs requires the bpf() syscall and an appropriate program type attachment path (LWT_SEG6LOCAL is attached to lightweight tunnel routes / segment-routing egress handling). This generally requires CAP_BPF/CAP_NET_ADMIN on modern kernels, or reachability via unprivileged-BPF configurations where kernel.unprivileged_bpf_disabled permits loading — no details on minimum privilege are provided in the source data, so this is stated at the vulnerability-class level.
• The per-CPU nature of the dangling pointer implies a write-what-where style primitive whose concrete address control depends on allocator behavior; no specifics are given in the advisory.

Insufficient technical detail is available to name additional functions, struct fields, or offsets beyond those quoted above; none are fabricated here.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-98383. The following chain is described strictly at the vulnerability-class level, using only symbols present in the advisory.

1. Reconnaissance / target identification. An attacker establishes local access to a Linux host (e.g., low-privileged shell, container breakout context, or an environment where BPF program loading is permitted). They determine whether the kernel exposes the LWT_SEG6LOCAL program type and the bpf_skb_pull_data() helper through the LWT helper set on that kernel build.

2. Triggering the flaw class. The attacker authors and loads an LWT_SEG6LOCAL BPF program that (a) calls bpf_lwt_seg6_adjust_srh(), thereby invalidating/caching the SRH pointer, and then (b) calls bpf_skb_pull_data(). On a vulnerable kernel the verifier accepts this helper combination; on a fixed kernel it rejects the program at load time.

3. Payload / execution method (class level). Because bpf_skb_pull_data() may reallocate skb->head, the retained per-CPU SRH pointer becomes dangling. When post-program SRH validation executes, it writes through this stale pointer. This is a dangling-pointer write primitive; the attacker's ability to steer the write depends on heap grooming and allocator state, which are not specified in the source data.

4. Post-exploitation impact. Successful triggering yields corruption of kernel memory via the dangling SRH write, providing a plausible path to privilege escalation and/or kernel crash (denial of service) in a context where the attacker already has local execution. Concrete post-exploitation primitives are not enumerated in the advisory and are not invented here.

No public exploitation has been observed; there is no CISA KEV listing and no known threat-actor campaign tied to this CVE in the provided data.

Impact Assessment

The vulnerability permits a write through a dangling kernel pointer following a sequence of BPF helper calls in an LWT_SEG6LOCAL program. Potential consequences include:

• Confidentiality (High): kernel-memory corruption and control-flow influence could expose kernel data.
• Integrity (High): an attacker-controlled write primitive can alter kernel state.
• Availability (High): unreliable pointer writes commonly produce kernel panics, yielding DoS.
• Scope (Changed): a BPF program running in an attached-LWT context affecting kernel-validator writes spans a security scope beyond the loading program's own context.

Blast radius is constrained to systems with affected kernels that expose the LWT_SEG6LOCAL/bpf_skb_pull_data() helper combination and where an attacker can reach the program-loading path. Because no CVSS score or EPSS score was provided or computed, no numeric severity is asserted. Exploitability in the wild is currently unproven: POC_STATUS is None, KEV is "NO", and no vendor fix is tracked (patch confidence 0/4), which raises the difficulty of confirming real-world exposure but does not by itself establish active exploitation.

Detection Guidance

Sigma Rule

title: Suspicious LWT_SEG6LOCAL BPF Program Load (CVE-2026-98383)
id: 7c3e9a12-4b21-4f8e-9d0a-3f1c6e5b2a91
status: experimental
description: Detects BPF program loads associated with LWT_SEG6LOCAL program type, which may be abused to trigger the dangling-SRH-pointer flaw (bpf_skb_pull_data after bpf_lwt_seg6_adjust_srh).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98383
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_tools:
    Image|endswith:
      - '/bpftool'
      - '/bpftrace'
    CommandLine|contains:
      - 'lwt_seg6local'
      - 'lwt_in'
      - 'lwt_out'
  selection_syscalls:
    CommandLine|contains:
      - 'bpf_skb_pull_data'
      - 'bpf_lwt_seg6_adjust_srh'
  condition: selection_tools or selection_syscalls
falsepositives:
  - Legitimate network engineering/debugging using bpftool to inspect LWT programs
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068

YARA Rule

rule CVE_2026_98383_LWT_SEG6_PULL_DATA
{
    meta:
        author = "Threat Intelligence"
        description = "Detects BPF bytecode/source referencing the unsafe LWT_SEG6LOCAL helper combination associated with CVE-2026-98383"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98383"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $srh  = "bpf_lwt_seg6_adjust_srh" ascii wide nocase
        $pull = "bpf_skb_pull_data" ascii wide nocase
        $lwt  = "LWT_SEG6LOCAL" ascii wide nocase
        $lwt2 = "lwt_seg6local" ascii wide nocase

    condition:
        ($srh and $pull) or ($srh and ($lwt or $lwt2))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98383 Potential LWT_SEG6LOCAL BPF Exploitation Activity"; flow:to_server; content:"LWT_SEG6LOCAL"; nocase; classtype:attempted-admin; reference:cve,2026-98383; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-98383; sid:202698383; rev:1;)

Note: CVE-2026-98383 is a local BPF verifier/flaw condition rather than a network-parsable protocol event; the rule above matches textual references to the affected program type in network-observable payloads and should be treated as a best-effort network signal. Host-based detection (Sigma/Wazuh/Elastic) is the primary detection surface.

Elastic Detection

process where event.type == "start" and process.name in ("bpftool", "bpftrace") and
  process.command_line : ("lwt_seg6local", "LWT_SEG6LOCAL", "bpf_lwt_seg6_adjust_srh", "bpf_skb_pull_data")

// Fileless / loader activity referencing the vulnerable helper set
process where event.action == "exec" and
  process.args : ("bpf_lwt_seg6_adjust_srh", "bpf_skb_pull_data") and
  process.args : ("lwt_seg6local")

This rule targets process telemetry for BPF loading tools that reference the vulnerable helper combination. Tune against legitimate network engineering baselines.

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
(process_name=bpftool OR process_name=bpftrace OR process_name=clang OR process_name=gcc)
("lwt_seg6local" OR "LWT_SEG6LOCAL" OR "bpf_skb_pull_data" OR "bpf_lwt_seg6_adjust_srh")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, command
| where count > 0
| sort - count

Correlate hits with index=linux sourcetype=kernel entries containing bpf or verifier messages around the same host/time.

Wazuh OSSEC Rule

<group name="linux,bpf,privilege_escalation,">
  <rule id="100983" level="10">
    <decoded_as>json</decoded_as>
    <field name="audit.exe">bpftool|bpftrace|clang|gcc</field>
    <match>lwt_seg6local|LWT_SEG6LOCAL</match>
    <description>CVE-2026-98383: Potential BPF LWT_SEG6LOCAL helper abuse detected (bpf_skb_pull_data / bpf_lwt_seg6_adjust_srh)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_98383,</group>
  </rule>

  <rule id="100984" level="12">
    <decoded_as>json</decoded_as>
    <field name="audit.exe">.*</field>
    <match>bpf_lwt_seg6_adjust_srh.*bpf_skb_pull_data</match>
    <description>CVE-2026-98383: Unsafe BPF helper sequence observed (dangling SRH pointer trigger)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_98383,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix version, workaround, or affected version list is available in the provided data. Treat the following as defensive guidance rather than confirmed vendor remediation.

1. Immediate mitigations

   • Restrict BPF program loading to privileged operators: enforce kernel.unprivileged_bpf_disabled=1 (sysctl kernel.unprivileged_bpf_disabled) to prevent unprivileged users from loading BPF programs on systems where this is not already configured.
   • Reduce who can attach LWT / segment-routing programs; require CAP_BPF/CAP_NET_ADMIN strictly and audit holders.
   • Apply seccomp/LSM policies that deny the bpf() syscall to processes that do not require it (containers, unprivileged workload profiles).
   • Monitor for anomalous use of bpftool/bpftrace/clang/gcc referencing lwt_seg6local.

2. Patch / upgrade steps

   • Monitor upstream Linux kernel stable releases for the fix commit implementing the verifier restriction that "Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs." Because patch confidence is 0/4 and no version list exists, no specific fixed version can be named here; validate against the official Linux kernel stable tree and your distribution's kernel security tracker.
   • Once a fixed kernel is available, schedule upgrade and reboot promptly for affected hosts, prioritizing systems exposing BPF to non-root or multi-tenant workloads.

3. Long-term hardening

   • Maintain kernel patch currency and enable verifier hardening features available in your kernel line.
   • Segment administrative and BPF-capable identities; adopt least-privilege capabilities.
   • Deploy the host-based detection rules above and baseline legitimate LWT/segment-routing program activity.

References

• NVD — CVE-2026-98383: https://nvd.nist.gov/vuln/detail/CVE-2026-98383
• Linux kernel BPF subsystem documentation and stable-tree change logs (track for the "Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL" fix): https://git.kernel.org/
• Linux kernel BPF verifier documentation (helper availability per program type): https://docs.kernel.org/bpf/
• CISA Known Exploited Vulnerabilities catalog (check for future CVE-2026-98383 listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/

No threat-actor campaign, exploit-in-the-wild evidence, public PoC, or Nuclei template is currently associated with CVE-2026-98383 in the provided data.