VulnerabilityPublished 19 Jul 2026

CVE-2026-63984: Linux kernel · ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Source GCVE Database

Authoritative record:CVE-2026-63984· Critical 9.8

Not known to be exploited · CVSS 9.8 Critical · fixed in fd238c51b0fa5390cceca9f1ac5a9ffda8063eed : patch Linux kernel as a priority.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 43% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fd238c51b0fa5390cceca9f1ac5a9ffda8063eed, de02fc049352af5a9595f015511222d0a85c326b, c0487a9c1e116cf349e2d1f302d9019670460858 +5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-6hh9-w4p2-c5qm

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3, < fd238c51b0fa5390cceca9f1ac5a9ffda8063eed	Fixed in fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
LinuxLinux	Affected ≥ 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3, < de02fc049352af5a9595f015511222d0a85c326b	Fixed in de02fc049352af5a9595f015511222d0a85c326b
LinuxLinux	Affected ≥ 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3, < c0487a9c1e116cf349e2d1f302d9019670460858	Fixed in c0487a9c1e116cf349e2d1f302d9019670460858
LinuxLinux	Affected ≥ 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3, < 3618b34942b76471d044369bfd30d58c39068bf1	Fixed in 3618b34942b76471d044369bfd30d58c39068bf1
LinuxLinux	Affected ≥ 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3, < 97e06791368c01f0ad2a4b3269c2abe19485ca32	Fixed in 97e06791368c01f0ad2a4b3269c2abe19485ca32
LinuxLinux	Affected ≥ 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3, < 75b3680047bf09af8e7e471a7a6ddf2ce5847f56	Fixed in 75b3680047bf09af8e7e471a7a6ddf2ce5847f56

AI-suggested

The fix involves tightening the bounds on the number of segments processed to prevent hdrlen overflow. If you cannot patch yet, avoid processing IPv6 RPL packets with an unusually high number of segments (>=127) if possible.

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.

Impact

The vulnerability causes memory corruption in the IPv6 routing header during packet forwarding, potentially leading to packet corruption or other undefined behavior in the kernel's IPv6 RPL processing. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits are reported in the wild.

Summary

The Linux kernel's ipv6_rpl_srh_decompress() function calculates hdrlen as an 8-bit unsigned integer. For n (number of segments) values of 127 or greater, the computed hdrlen exceeds 255 and truncates to 0, causing the compressed header to overlap with the decompressed data buffer. This overlap results in corruption of the routing header during packet forwarding. The existing check only prevents n+1 from exceeding 255 but does not prevent hdrlen overflow. The fix restricts n to a maximum of 126, ensuring hdrlen fits within 8 bits and preventing buffer overlap.

References

Community reviews

Loading reviews…