CVE-2026-63922 (GCVE-0-2026-63922)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
ipv6: exthdrs: refresh nh after handling HAO option
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < b3ac54e5c905f86d22b502eacb5686a282c5659f (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < f8aabed3ff3e986920cf02a2a2785e08e586b234 (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < 12d957979e4a800167842f1b42be6a606d227ebe (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < ff375ed1cba81392346c5bfbf0bb7a13b2946f99 (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < 751db1b802a067b7fff25880f4e9f9152a171538 (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < 9b6dcc0a39fd71752937f0b6b3973e1416085dcf (git)
Affected: a831f5bbc89a9978795504be9e1ff412043f8f77 , < f7b52afe3592eae66e160586b45a3f2242972c63 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.19
Unaffected: 0 , < 2.6.19 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/exthdrs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3ac54e5c905f86d22b502eacb5686a282c5659f",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "f8aabed3ff3e986920cf02a2a2785e08e586b234",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "12d957979e4a800167842f1b42be6a606d227ebe",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "ff375ed1cba81392346c5bfbf0bb7a13b2946f99",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "751db1b802a067b7fff25880f4e9f9152a171538",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "9b6dcc0a39fd71752937f0b6b3973e1416085dcf",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            },
            {
              "lessThan": "f7b52afe3592eae66e160586b45a3f2242972c63",
              "status": "affected",
              "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/exthdrs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv \u2192 ip6_input \u2192 ip6_protocol_deliver_rcu \u2192 ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel\u2019s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:16.967Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"
        },
        {
          "url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"
        }
      ],
      "title": "ipv6: exthdrs: refresh nh after handling HAO option",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63922",
    "datePublished": "2026-07-19T14:55:24.268Z",
    "dateReserved": "2026-07-19T07:54:57.021Z",
    "dateUpdated": "2026-08-05T12:37:16.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63922",
      "date": "2026-10-01",
      "epss": "0.00714",
      "percentile": "0.51945"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/exthdrs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b3ac54e5c905f86d22b502eacb5686a282c5659f",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f8aabed3ff3e986920cf02a2a2785e08e586b234",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "12d957979e4a800167842f1b42be6a606d227ebe",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ff375ed1cba81392346c5bfbf0bb7a13b2946f99",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "751db1b802a067b7fff25880f4e9f9152a171538",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9b6dcc0a39fd71752937f0b6b3973e1416085dcf",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7b52afe3592eae66e160586b45a3f2242972c63",
                    "status": "affected",
                    "version": "a831f5bbc89a9978795504be9e1ff412043f8f77",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv6/exthdrs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.19"
                  },
                  {
                    "lessThan": "2.6.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage."
          }
        ],
        "id": "CVE-2026-63922",
        "lastModified": "2026-07-28T14:16:39.443",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:10.440",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-07-21T21:30:49+00:00",
      "cve": "CVE-2026-63922",
      "id": "CVE-2026-63922",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "1",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: exthdrs: refresh nh after handling HAO option",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63922.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-01T00:48:33Z",
      "cve": "CVE-2026-63922",
      "id": "CVE-2026-63922",
      "initial_release_date": "2026-07-21T13:03:30Z",
      "product_status:known_affected": "442",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "480",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63922",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63922.json",
      "version": "15"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.