CVE-2026-72400

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires loading BPF LWT SEG6 programs and attaching SRv6 routes via bpf() and RTNETLINK; the OOB read is triggered through bpf_lwt_push_encap/bpf_lwt_seg6_action helpers, not by remote IPv6 packet parsing alone.

AC:LAttack complexity, low

An attacker with route/BPF setup privileges can deterministically call bpf_push_seg6_encap() or bpf_lwt_seg6_action(END_B6/END_B6_ENCAP) with a 2-byte buffer, immediately forcing seg6_validate_srh() to read fixed SRH fields past the buffer end.

PR:LPrivileges required, low

Loading BPF_PROG_TYPE_LWT_IN/LWT_SEG6LOCAL and installing SRv6 LWT routes requires CAP_NET_ADMIN, obtainable by unprivileged users inside user/network namespaces (unshare -Urn), not only init-namespace root.

UI:NUser interaction, none

No victim interaction is required; triggering the bug needs only attacker-controlled BPF execution during SRv6/LWT packet processing after the attacker configures routes and programs.

S:UScope, unchanged

Impact is confined to kernel memory safety within the same host security boundary; there is no VM escape, sandbox breakout, or cross-authority scope change beyond standard local kernel compromise.

C:HConfidentiality impact, high

seg6_validate_srh() performs out-of-bounds reads of SRH header bytes (e.g., srh->type at offset 2) beyond the attacker-supplied length, disclosing adjacent kernel/BPF stack memory that may include pointers and sensitive metadata.

I:HIntegrity impact, high

Kernel out-of-bounds reads in this validation path constitute memory-safety corruption that can be chained with disclosed pointers and heap/stack layout control from BPF context to obtain arbitrary write or code-execution primitives.

A:HAvailability impact, high

Undersized SRH buffers can cause seg6_validate_srh() to read past mapped BPF/kernel memory and trigger kernel faults, oops, or panic on SRv6 routers processing attacker-driven BPF SEG6 encap traffic.