CVE-2026-63920
Received Received - Intake

Heap Buffer Overflow in Linux Kernel IPv6 Extension Header Handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), etc.). An nftables payload-write expression can rewrite hdrlen after parsing and before the skb reaches recvmsg; the write itself is in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040 bytes from an 8-byte header. nftables is reachable from an unprivileged user namespace, so this is an unprivileged slab-out-of-bounds read: BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540 put_cmsg+0x3ac/0x540 udpv6_recvmsg+0xca0/0x1250 sock_recvmsg+0xdf/0x190 ____sys_recvmsg+0x1b1/0x620 Add ipv6_get_exthdr_len() which validates that at least two bytes are accessible before reading the hdrlen field, then checks the computed length against skb_tail_pointer(skb), returning 0 on failure. Extension headers are kept in the linear skb area by pskb_may_pull() during input, so skb_tail_pointer() is the correct bound. Use ipv6_get_exthdr_len() at all non-AH call sites: the five standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR) and the three standard cases in the extension-header walk loop (DSTOPTS, ROUTING, default). AH retains an inline bounds check because its length formula differs ((ptr[1]+2)<<2). The walk loop also gets a pre-read bounds check at the top to validate ptr before any case accesses ptr[0] or ptr[1]. When the walk loop detects a corrupted header, return from the function instead of continuing to process later socket options.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63920
EUVD
EUVD-2026-45693

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an out-of-bounds read issue in IPv6 extension header handling. The flaw occurs when processing IPv6 control messages (cmsgs) for hop-by-hop, destination, and routing options. The kernel trusts the header length byte from the network packet without proper validation before copying data to user space. An attacker in an unprivileged user namespace could exploit this via nftables payload-write to trigger a slab-out-of-bounds read in the put_cmsg function.

Detection Guidance

This vulnerability involves an out-of-bounds read in the Linux kernel's IPv6 extension header handling. Detection requires checking kernel logs for KASAN (Kernel Address Sanitizer) reports indicating slab-out-of-bounds errors in put_cmsg or related functions. Monitor logs for crashes or warnings from ipv6-related modules.

Impact Analysis

This vulnerability could allow an attacker with access to an unprivileged user namespace to read sensitive kernel memory. This might lead to information disclosure, privilege escalation, or system crashes. Attackers could exploit it to access data they should not have permission to see, potentially compromising confidentiality and system integrity.

Compliance Impact

This vulnerability is a slab-out-of-bounds read in the Linux kernel's IPv6 extension header handling. It does not directly affect compliance with GDPR or HIPAA as it is a low-level memory corruption issue rather than a data exposure or privacy violation. However, if exploited, it could potentially lead to system instability or crashes, indirectly impacting availability of systems handling regulated data.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to address the issue. If immediate patching is not possible, consider disabling unprivileged user namespaces or restricting access to nftables to reduce attack surface. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart