CVE-2026-72400

A flaw was found in the Linux kernel's Segment Routing over IPv6 (SEG6) component. Insufficient validation of the Segment Routing Header (SRH) length before reading its fixed fields can lead to an out-of-bounds read. A local attacker, by crafting a malicious BPF (Berkeley Packet Filter) program, could provide a short SEG6 encapsulation header, causing the system to read beyond the allocated buffer. This could result in information disclosure or potentially a denial of service.

An out-of-bounds read flaw rated Moderate by Red Hat was found in the Linux kernel's Segment Routing over IPv6 (SEG6) implementation in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The seg6_validate_srh() function reads fixed Segment Routing Header (SRH) fields, such as type and hdrlen, before checking that the supplied buffer length covers the fixed struct ipv6_sr_hdr fields. A local attacker able to load and attach a crafted BPF program, for example through bpf_lwt_push_encap() or the SEG6 local END_B6 and END_B6_ENCAP actions, could supply a 2-byte SEG6 encapsulation header and cause the kernel to read beyond the caller-supplied buffer. The over-read is limited to a few header bytes, so the practical impact is a small information disclosure or a local denial of service; there is no evidence of a write primitive or privilege escalation. Exploitation requires local access with privileges to load BPF programs (such as CAP_BPF or CAP_SYS_ADMIN), which limits exposure. Red Hat Enterprise Linux 6 and 7 are listed as not affected because the vulnerable code is not present in those streams. For the affected Red Hat Enterprise Linux 8, 9, and 10 and Red Hat In-Vehicle OS kernel streams the fix is currently deferred to a future update; the residual risk of deferring is considered low because of the local privilege requirement and the limited nature of the out-of-bounds read. Red Hat rates this flaw Moderate with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE.org record scores it 7.8 (C:H/I:H/A:H); the difference reflects Red Hat's assessment that only a short header-field read is possible, with no supported confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.