In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()… (CVE-2026-63984)
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
AI Analysis
Technical Summary
The Linux kernel's ipv6_rpl_srh_decompress() function calculates hdrlen as an 8-bit unsigned integer. For n (number of segments) values of 127 or greater, the computed hdrlen exceeds 255 and truncates to 0, causing the compressed header to overlap with the decompressed data buffer. This overlap results in corruption of the routing header during packet forwarding. The existing check only prevents n+1 from exceeding 255 but does not prevent hdrlen overflow. The fix restricts n to a maximum of 126, ensuring hdrlen fits within 8 bits and preventing buffer overlap.
Potential Impact
The vulnerability causes memory corruption in the IPv6 routing header during packet forwarding, potentially leading to packet corruption or other undefined behavior in the kernel's IPv6 RPL processing. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves tightening the bounds on the number of segments processed to prevent hdrlen overflow. Until an official patch is available, avoid processing IPv6 RPL packets with an unusually high number of segments (>=127) if possible.
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()… (CVE-2026-63984)
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ipv6_rpl_srh_decompress() function calculates hdrlen as an 8-bit unsigned integer. For n (number of segments) values of 127 or greater, the computed hdrlen exceeds 255 and truncates to 0, causing the compressed header to overlap with the decompressed data buffer. This overlap results in corruption of the routing header during packet forwarding. The existing check only prevents n+1 from exceeding 255 but does not prevent hdrlen overflow. The fix restricts n to a maximum of 126, ensuring hdrlen fits within 8 bits and preventing buffer overlap.
Potential Impact
The vulnerability causes memory corruption in the IPv6 routing header during packet forwarding, potentially leading to packet corruption or other undefined behavior in the kernel's IPv6 RPL processing. There is no indication of remote code execution or privilege escalation from the provided data. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The fix involves tightening the bounds on the number of segments processed to prevent hdrlen overflow. Until an official patch is available, avoid processing IPv6 RPL packets with an unusually high number of segments (>=127) if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6hh9-w4p2-c5qm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63984"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912e22d
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:02:36 UTC
Last updated: 07/20/2026, 21:51:32 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.