CVE-2026-53263 describes an off-by-one error in the Linux kernel's 6lowpan protocol implementation, specifically in the lowpan_iphc_mcast_ctx_addr_compress() function. The second memcpy operation incorrectly uses &data[1] and &ipaddr->s6_addr[11] as source and destination pointers, respectively, instead of the correct &data[2] and &ipaddr->s6_addr[12]. This causes corruption of the RIID field in the compressed multicast address and omission of writing to data[5], leading to transmission of uninitialized kernel stack memory via lowpan_push_hc_data(). The fix involves correcting these offsets and zero-initializing the data array to prevent leakage of kernel stack contents.

The vulnerability results in leakage of uninitialized kernel stack memory over the network, which can disclose sensitive kernel memory contents. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. However, the primary concern is information leakage of kernel stack data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description states it has been resolved by correcting the memcpy offsets and zero-initializing the data array. Users should monitor official Linux kernel advisories for patches addressing this issue and apply them when available.