CVE-2026-63984ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 75b3680047bf09af8e7e471a7a6ddf2ce5847f56; from 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 before fd238c51b0fa5390cceca9f1ac5a9ffda8063eed; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 3618b34942b76471d044369bfd30d58c39068bf1; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 97e06791368c01f0ad2a4b3269c2abe19485ca32; from 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 before de02fc049352af5a9595f015511222d0a85c326b; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 6fe1cb312038516cb4d9fa089d700af7059f1a64; from 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 before c0487a9c1e116cf349e2d1f302d9019670460858; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 9d5e7a46a9f6d8f503b41bfefef70659845f1679 | CNA record |
References
- https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56
- https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
- https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1
- https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32
- https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b
- https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64
- https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858
- https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.