CVE-2026-98306

A flaw was found in the Linux kernel's IPv6 Segment Routing (SRv6) subsystem. When decapsulating IPv4 network traffic on an interface bound to a Virtual Routing and Forwarding (VRF) domain—a feature used to isolate network traffic—the kernel fails to properly preserve routing domain flags. A remote attacker could exploit this vulnerability by sending SRv6 packets to an affected system. This flaw allows decapsulated network traffic to bypass VRF isolation boundaries and be delivered to unintended listening sockets outside the isolated domain, potentially resulting in unauthorized data exposure.

An SRv6 End.DX4 decapsulation path can lose the L3 slave marker when converting the outer IPv6 control block into the inner IPv4 control block. The decapsulated packet can therefore be processed as if it belonged to the default VRF, allowing an unbound socket outside the ingress VRF to receive traffic that should remain scoped to the enslaved interface. This creates a potential VRF isolation bypass with limited confidentiality and integrity impact, while the intended VRF bound socket may not receive the packet. For the CVSS the PR:N value is selected because a remote sender does not need an account or privileges on the target when the configured SRv6 endpoint is reachable. Exploitation requires a system using SRv6 End.DX4 with a VRF enslaved ingress interface and a packet addressed so that processing reaches local socket lookup. The issue is network reachable, although practical exposure is generally limited to routed SRv6 infrastructure or controlled service provider and data center networks. There is no memory corruption primitive or evidence of privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.