In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver… (CVE-2026-63870)
A vulnerability in the Linux kernel's 6LoWPAN implementation allowed non-IPv6 packets to be processed improperly in the lowpan_xmit() function, leading to use of uninitialized data. This occurs because the 6LoWPAN header creation functions return early for non-IPv6 packets without initializing necessary structures, but the transmit function still uses these uninitialized structures. The issue was fixed by dropping non-IPv6 packets in the affected code paths.
AI Analysis
Technical Summary
The Linux kernel's ieee802154 6LoWPAN driver had a vulnerability where non-IPv6 packets (e.g., ETH_P_AOE) queued for transmission on a 6LoWPAN interface were not properly handled. The lowpan_header_create function returned early without initializing the lowpan_addr_info structure in the skb headroom for these packets. However, the lowpan_xmit transmit function unconditionally used this uninitialized data, potentially causing undefined behavior. The fix involved dropping non-IPv6 packets to prevent use of uninitialized memory. A similar fix was applied to the Bluetooth 6LoWPAN transmit function (bt_xmit).
Potential Impact
The vulnerability could lead to the use of uninitialized memory in kernel space during packet transmission on 6LoWPAN interfaces, which may cause kernel instability or unpredictable behavior. No known exploits in the wild have been reported. The impact is limited to scenarios where non-IPv6 packets are transmitted over 6LoWPAN interfaces.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to drop non-IPv6 packets in the 6LoWPAN transmit functions, preventing the use of uninitialized data. Since no patch links or vendor advisories are provided, check the official Linux kernel repositories or vendor advisories for the specific patch and update to a fixed kernel version when available. Until then, avoid transmitting non-IPv6 packets over 6LoWPAN interfaces.
In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver… (CVE-2026-63870)
Description
A vulnerability in the Linux kernel's 6LoWPAN implementation allowed non-IPv6 packets to be processed improperly in the lowpan_xmit() function, leading to use of uninitialized data. This occurs because the 6LoWPAN header creation functions return early for non-IPv6 packets without initializing necessary structures, but the transmit function still uses these uninitialized structures. The issue was fixed by dropping non-IPv6 packets in the affected code paths.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ieee802154 6LoWPAN driver had a vulnerability where non-IPv6 packets (e.g., ETH_P_AOE) queued for transmission on a 6LoWPAN interface were not properly handled. The lowpan_header_create function returned early without initializing the lowpan_addr_info structure in the skb headroom for these packets. However, the lowpan_xmit transmit function unconditionally used this uninitialized data, potentially causing undefined behavior. The fix involved dropping non-IPv6 packets to prevent use of uninitialized memory. A similar fix was applied to the Bluetooth 6LoWPAN transmit function (bt_xmit).
Potential Impact
The vulnerability could lead to the use of uninitialized memory in kernel space during packet transmission on 6LoWPAN interfaces, which may cause kernel instability or unpredictable behavior. No known exploits in the wild have been reported. The impact is limited to scenarios where non-IPv6 packets are transmitted over 6LoWPAN interfaces.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to drop non-IPv6 packets in the 6LoWPAN transmit functions, preventing the use of uninitialized data. Since no patch links or vendor advisories are provided, check the official Linux kernel repositories or vendor advisories for the specific patch and update to a fixed kernel version when available. Until then, avoid transmitting non-IPv6 packets over 6LoWPAN interfaces.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-phq6-q8j5-j858
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63870"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27ac2a4a8d5989130306
Added to database: 07/19/2026, 19:38:20 UTC
Last enriched: 07/19/2026, 20:13:44 UTC
Last updated: 07/20/2026, 17:26:47 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.