CVE-2026-63870
Received Received - Intake

6LoWPAN Non-IPv6 Packet Handling Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63870
EUVD
EUVD-2026-45555

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of non-IPv6 packets on 6LoWPAN interfaces. When a non-IPv6 packet (like ETH_P_AOE) is transmitted via a 6LoWPAN interface, the header creation function fails to initialize critical address information. The transmit function then uses this uninitialized data, potentially leading to undefined behavior or crashes.

Detection Guidance

This vulnerability involves non-IPv6 packets being processed on 6LoWPAN interfaces. Detection requires checking for such packets on affected systems. Inspect network interfaces for 6LoWPAN configurations and monitor for non-IPv6 traffic. No specific commands are provided in the context.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior when non-IPv6 packets are transmitted over 6LoWPAN interfaces. It may lead to denial-of-service conditions or data corruption if exploited maliciously.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a kernel-level issue in 6LoWPAN packet handling that could lead to uninitialized memory exposure during transmission, but no evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Apply the Linux kernel patch that drops non-IPv6 packets in 6LoWPAN interfaces to prevent uninitialized memory usage. Update to a fixed kernel version where the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63870. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart