---
id: CVE-2025-38310
title: 'seg6: Fix validation of nexthop addresses'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  seg6: Fix validation of nexthop addresses

  The kernel currently validates that the length of the provided nexthop
  address does not exceed the specified length. This can…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 <
    668923c474608dd9ebce0fbcc41bd8a27aa73dd6
  - >-
    Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 <
    cef33a86bcb04ecf4dc10c56f6c42ee9d1c54bac
  - >-
    Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 <
    d2507aeea45b3c5aa24d5daae0cf3db76895c0b7
  - >-
    Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 <
    d5d9fd13bc19a3f9f2a951c5b6e934d84205789e
  - >-
    Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 <
    cd4cd09810211fa23609c5c1018352e9e1cd8e5a
  - >-
    Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 <
    7632fedb266d93ed0ed9f487133e6c6314a9b2d1
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:54:08.589388Z'
published: '2025-07-10'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:32.010Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38310'
references:
  - url: 'https://git.kernel.org/stable/c/668923c474608dd9ebce0fbcc41bd8a27aa73dd6'
  - url: 'https://git.kernel.org/stable/c/cef33a86bcb04ecf4dc10c56f6c42ee9d1c54bac'
  - url: 'https://git.kernel.org/stable/c/d2507aeea45b3c5aa24d5daae0cf3db76895c0b7'
  - url: 'https://git.kernel.org/stable/c/d5d9fd13bc19a3f9f2a951c5b6e934d84205789e'
  - url: 'https://git.kernel.org/stable/c/cd4cd09810211fa23609c5c1018352e9e1cd8e5a'
  - url: 'https://git.kernel.org/stable/c/7632fedb266d93ed0ed9f487133e6c6314a9b2d1'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.06277
ingestedAt: '2026-11-05T22:38:31.951Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

seg6: Fix validation of nexthop addresses

The kernel currently validates that the length of the provided nexthop
address does not exceed the specified length. This can lead to the
kernel reading uninitialized memory if user space provided a shorter
length than the specified one.

Fix by validating that the provided length exactly matches the specified
one.

## Affected

- `Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 < 668923c474608dd9ebce0fbcc41bd8a27aa73dd6`
- `Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 < cef33a86bcb04ecf4dc10c56f6c42ee9d1c54bac`
- `Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 < d2507aeea45b3c5aa24d5daae0cf3db76895c0b7`
- `Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 < d5d9fd13bc19a3f9f2a951c5b6e934d84205789e`
- `Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 < cd4cd09810211fa23609c5c1018352e9e1cd8e5a`
- `Linux >= d1df6fd8a1d22d37cffa0075ab8ad423ce656777 < 7632fedb266d93ed0ed9f487133e6c6314a9b2d1`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.