CVE-2026-72400

The vulnerability in seg6_validate_srh() is a classic read-before-validate flaw: the function accesses srh->type and srh->hdrlen at offsets 2 and 3 before checking that the supplied buffer is actually large enough to contain those fields. When a BPF program calls bpf_push_seg6_encap() with length=2, the kernel performs an out-of-bounds heap read at offset 2 before any semantic validation occurs. This is deterministic and repeatable — no timing jitter or heap grooming required. What elevates this from a typical information disclosure is the execution context. The over-read happens in the packet ingress path, in encapsulation processing, before SRH semantic handling begins. An attacker controlling the length parameter can probe sequential heap contents across multiple packets. The adjacent data often includes socket buffers, packet metadata, and session state from concurrent connections — operationally valuable for traffic analysis or exploit development. The fix adds a length guard at the top of seg6_validate_srh() before any header field access. This is the correct immediate response, but you should treat it as a boundary marker rather than a complete solution. Examine whether other callers of seg6_validate_srh() could trigger the same condition through non-BPF paths. Verify whether the fix pattern extends to seg6_set_encap() and related encapsulation helpers — the patch addresses one function, but the underlying assumption of caller-supplied buffer size may persist in adjacent code. Your priority actions: confirm the patched version is deployed, audit any custom BPF programs using seg6 encapsulation helpers to ensure they're not passing undersized buffers that could trigger the over-read, and treat this as a signal to review other SEG6 validation functions for similar read-before-validate patterns. The BPF integration didn't create new vulnerability — it exposed the assumption that no untrusted caller would ever reach this code path.

Reviewed through automated stages and approved by a human before publication.