CVE-2026-72400

In the Linux kernel, the following vulnerability has been resolved:

seg6: validate SRH length before reading fixed fields

seg6_validate_srh() reads fixed SRH fields such as srh->type and

srh->hdrlen before checking that the supplied length covers the fixed

struct ipv6_sr_hdr fields.

The BPF SEG6 encap path reaches this with a BPF program-supplied pointer

and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and

END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the

length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6

encap header can therefore make the validator read srh->type at offset 2

beyond the caller-supplied buffer.

Reject lengths shorter than the fixed SRH at the top of

seg6_validate_srh(), before any field is read. This fixes the BPF helper

path and keeps the common validator robust.