CVE-2026-98383: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98383 is a Linux kernel vulnerability in the BPF subsystem affecting LWT_SEG6LOCAL eBPF programs, where an unsafe combination of bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data() can produce a dangling pointer leading to kernel memory corruption. It affects Linux kernel versions starting from 4.18 up to the patched stable releases. The vulnerability was published on October 9, 2026, with patches available across multiple stable branches. The CVSS estimate is Medium severity, with an EPSS score of approximately 0.164% (GitHub Advisory, Feedly).

The root cause is a use-after-free / dangling pointer condition (CWE-416) in the Linux kernel's BPF LWT_SEG6LOCAL program type. An LWT_SEG6LOCAL program can call bpf_lwt_seg6_adjust_srh() to invalidate its cached Segment Routing Header (SRH), and subsequently invoke bpf_skb_pull_data(), which may reallocate skb->head. This reallocation leaves the per-CPU SRH pointer dangling; when post-program SRH validation then writes through this stale pointer, arbitrary kernel memory corruption can occur. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs at the BPF verifier level, so the unsafe helper combination is rejected before the program can be loaded (GitHub Advisory, Kernel Stable).

A local user with the capability to load LWT_SEG6LOCAL eBPF programs can exploit this vulnerability to corrupt kernel memory via a dangling pointer write, potentially achieving arbitrary code execution in kernel context. Successful exploitation could result in full system compromise, privilege escalation, or denial of service. The impact is limited to local attackers with eBPF program loading privileges, reducing the attack surface compared to remotely exploitable vulnerabilities (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.164%, reflecting a low probability of near-term exploitation. Exploitation requires local access and the ability to load eBPF programs, which typically requires elevated privileges or specific kernel configurations (e.g., unprivileged BPF enabled).

Patches have been backported to multiple Linux stable branches. The fixed versions are: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5 (GitHub Advisory, Kernel Stable). As an interim workaround where immediate patching is not possible, restrict the ability to load eBPF programs to trusted/privileged users only by setting kernel.unprivileged_bpf_disabled=1 via sysctl. Upgrading to a patched kernel version is the recommended long-term remediation.