Look up another CVE · open CVE-2026-63984 in the interactive tracker
CVE-2026-63984
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/ipv6. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63984 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv6/exthdrs.c
- What this is
- NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv6/exthdrs.c · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_IPV6 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_IPV6
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv6
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.7 | 5.10.259 | 75b3680047bf |
| 5.7 | 5.15.210 | fd238c51b0fa |
| 5.7 | 6.1.176 | 3618b34942b7 |
| 5.7 | 6.6.143 | 97e06791368c |
| 5.7 | 6.12.93 | de02fc049352 |
| 5.7 | 6.18.35 | 6fe1cb312038 |
| 5.7 | 7.0.12 | c0487a9c1e11 |
| 5.7 | 7.1 | 9d5e7a46a9f6 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.
- AC:LAttack complexity, low
- Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.
- PR:NPrivileges required, none
- No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.
- UI:NUser interaction, none
- Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.
- S:UScope, unchanged
- Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.
- C:HConfidentiality impact, high
- The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.
- I:HIntegrity impact, high
- ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.
- A:HAvailability impact, high
- Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs.