CVE-2026-98531

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: enforce exact attribute length for SEG6 ATTR DST

In seg6 genl policy, SEG6 ATTR DST is defined with .type = NLA BINARY and .len = sizeof(struct in6 addr). For NLA BINARY, .len only enforces the maximum payload length and permits shorter payloads (e.g., 0 bytes). When seg6 genl set tunsrc() copies sizeof(struct in6 addr) bytes via kmemdup(val, sizeof(*val), GFP KERNEL), a short SEG6 ATTR DST attribute triggers a 16-byte out-of-bounds read past skb->tail into uninitialized skb->head memory, which is stored in sdata->tun src and leaked back to userspace via SEG6 CMD GET TUNSRC.

Switch SEG6 ATTR DST in seg6 genl policy to NLA POLICY EXACT LEN(sizeof(struct in6 addr)) so that generic netlink validation rejects any attribute whose length is not exactly sizeof(struct in6 addr) with -ERANGE.

Tested in QEMU against Linux 7.3.0-rc3 by sending a SEG6 CMD SET TUNSRC Generic Netlink message with a 0-byte SEG6 ATTR DST attribute followed by SEG6 CMD GET TUNSRC. On the unfixed kernel, SEG6 CMD SET TUNSRC succeeds (err = 0) and SEG6 CMD GET TUNSRC leaks 16 bytes of uninitialized kernel heap memory (tun src = 836a61ecc4d25a1042a8d60411cfb378); with this patch applied, SEG6 CMD SET TUNSRC is rejected by netlink policy validation with -ERANGE (-34) and tun src remains zeroed.