CVE-2026-63984
Received Received - Intake

Integer Overflow in Linux Kernel IPv6 RPL SRH Decompression

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63984
EUVD
EUVD-2026-45757

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) implementation. It involves an integer overflow in the ipv6_rpl_srh_decompress() function where the header length calculation can exceed the maximum value of an 8-bit unsigned integer (__u8). This causes the header length to wrap around to zero, leading to a buffer overflow when the compressed header is placed incorrectly, corrupting packet data.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 RPL implementation and requires kernel-level inspection. Detection involves checking kernel version and configuration. Use 'uname -a' to verify kernel version and 'sysctl net.ipv6.conf.all.forwarding' to check IPv6 forwarding. If using RPL, inspect routing headers with 'ip -6 route show'. No direct commands detect this without kernel source analysis.

Impact Analysis

This vulnerability could allow an attacker to corrupt network packets in systems using IPv6 RPL, potentially causing denial-of-service conditions or packet forwarding issues. It may disrupt routing operations in low-power networks, though realistic exploitation is limited due to the high number of segments required (127).

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue in IPv6 RPL header handling that could lead to packet corruption or crashes, but there is no evidence it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel security update. If immediate patching is not possible, disable IPv6 RPL routing with 'sysctl -w net.ipv6.conf.all.rpl=0' or block malformed IPv6 packets at network perimeter. Monitor for unusual IPv6 traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart