CVE-2026-98531

waiting for further signals

GHSA-365h-h8v6-r47m ↗EUVD-2026-103576 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Linux 4.10

fixed in 050a0aa3c80907b8c60a396b7e04d48d8b1a9e70, 209eefebee54c4a5f01d68b61e8ac9881eca2de9, e3ac68c1cdc2535d127b2bfd50c263d16c8e4199, 66bf65fa109326e4c4ddeb0b94093379f72838fd, 195813bb7324c338eaba0aaa02b18681ee65b670, 6fcfc362344edea745a69f3a705de50b731f3418, 94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e, 2d959c75c27f90e9ec489d18ce5ee6b852ad4741

ETK-2026-2271, permanent identifier

1h 11msince last run

17mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+59h45m

+2h

+4h

+6h

+8h

+10h

description

Linux kernels with the affected IPv6 Segment Routing generic-netlink handler may read past a malformed destination attribute and expose uninitialized kernel memory in a subsequent response. Exploitation requires the ability to send the relevant Segment Routing generic-netlink requests.

mitigation

Update to a Linux kernel containing the fix for your maintained branch, such as commit 050a0aa3c80907b8c60a396b7e04d48d8b1a9e70 or another listed fixed commit. Until updated, restrict access to the affected generic-netlink interface where operationally feasible.

check

exploit

automation

contextual

auth required

–

EPSS

–

agent run time

17m

cve.org record, t = 0

2026-10-18 15:17Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-18 15:17Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-98531

this entry in the feed

GET /api/v1/feed/CVE-2026-98531

{
  "etk_id": "ETK-2026-2271",
  "cve_id": "CVE-2026-98531",
  "display_id": "CVE-2026-98531",
  "ghsa_id": "GHSA-365h-h8v6-r47m",
  "euvd_id": "EUVD-2026-103576",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Out-of-bounds read in Linux IPv6 Segment Routing netlink handling",
  "summary": "Linux kernels with the affected IPv6 Segment Routing generic-netlink handler may read past a malformed destination attribute and expose uninitialized kernel memory in a subsequent response. Exploitation requires the ability to send the relevant Segment Routing generic-netlink requests.",
  "mitigation": "Update to a Linux kernel containing the fix for your maintained branch, such as commit 050a0aa3c80907b8c60a396b7e04d48d8b1a9e70 or another listed fixed commit. Until updated, restrict access to the affected generic-netlink interface where operationally feasible.",
  "vendor": "Linux",
  "product": "Linux",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 050a0aa3c80907b8c60a396b7e04d48d8b1a9e70",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 209eefebee54c4a5f01d68b61e8ac9881eca2de9",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < e3ac68c1cdc2535d127b2bfd50c263d16c8e4199",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 66bf65fa109326e4c4ddeb0b94093379f72838fd",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 195813bb7324c338eaba0aaa02b18681ee65b670",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 6fcfc362344edea745a69f3a705de50b731f3418",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e",
        ">= 915d7e5e5930b4f01d0971d93b9b25ed17d221aa, < 2d959c75c27f90e9ec489d18ce5ee6b852ad4741"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "050a0aa3c80907b8c60a396b7e04d48d8b1a9e70",
        "209eefebee54c4a5f01d68b61e8ac9881eca2de9",
        "e3ac68c1cdc2535d127b2bfd50c263d16c8e4199",
        "66bf65fa109326e4c4ddeb0b94093379f72838fd",
        "195813bb7324c338eaba0aaa02b18681ee65b670",
        "6fcfc362344edea745a69f3a705de50b731f3418",
        "94214cf0a08dd2c5f37aeeea46078d9dfe8e4a0e",
        "2d959c75c27f90e9ec489d18ce5ee6b852ad4741"
      ],
      "package_name": "Linux",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "4.10"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Linux",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.865535,
  "t0_at": "2026-10-18T15:17:49.632000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-18T15:17:49.632000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-18T15:17:49.632000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98531"
    }
  }
}

published 2026-10-21 02:46Z
last change 2026-10-21 03:59Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.