CVE-2026-72400

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The seg6 validate srh() function reads fixed Segment Routing Header (SRH) fields, specifically srh->type and srh->hdrlen, before verifying if the provided length covers the fixed struct ipv6 sr hdr fields. In the BPF SEG6 encap path, bpf lwt push encap() and the SEG6 local BPF END B6 and END B6 ENCAP actions call bpf push seg6 encap(), which passes the length to seg6 validate srh() without a minimum-size guard. Consequently, a 2-byte SEG6 encap header can cause the validator to read srh->type at an offset 2 bytes beyond the caller-supplied buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.