CVE-2026-53263
6lowpan: fix off-by-one in multicast context address compression
Description
In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future.
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 8, 2026, 4:02 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest version.
- Apply the provided patch for 6lowpan.
- Zero-initialize the data array defensively.
- Verify correct data layout in compression/decompression.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53263.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53263 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53263
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53263 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53263 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-193 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.176 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.210 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.94 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.6 up to (excluding) 5.10.259 Added Reference Type kernel.org: https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f24a58c72a45f4c109f3557a760cc4b60b7a6037 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': 'f24a58c72a45f4c109f3557a760cc4b60b7a6037', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': 'da8cbb64b47e9066b40af0de170901caf17b768c', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': '4485d79617520d84ba5a14515e2b5136007d6deb', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': '06ce6fc106b16dec9b535950db626261be865e5b', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': 'dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': 'c32f30ef5e66adbfa102348e2e8a23776eb007cb', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': 'da8808463882c3f3c357b072e25053c2121f1419', 'versionType': 'git'}, {'status': 'affected', 'version': '5609c185f24dffca5f6a9c127106869da150be03', 'lessThan': '2a58899d11009bffc7b4b32a571858f381121837', 'versionType': 'git'}], 'programFiles': ['net/6lowpan/iphc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.6'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.6', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.94', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.36', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.13', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/6lowpan/iphc.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses &data[1] as destination and &ipaddr->s6_addr[11] as source, but both should be offset by one: &data[2] and &ipaddr->s6_addr[12] respectively. This off-by-one has two consequences: 1. data[1] is overwritten with s6_addr[11], corrupting the RIID field in the compressed multicast address 2. data[5] is never written, so uninitialized kernel stack memory is transmitted over the network via lowpan_push_hc_data(), leaking kernel stack contents The correct inline data layout must match what the decompression function lowpan_uncompress_multicast_ctx_daddr() expects: data[0..1] = s6_addr[1..2] (flags/scope + RIID) data[2..5] = s6_addr[12..15] (group ID) Also zero-initialize the data array as a defensive measure against similar bugs in the future. Added Reference https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b Added Reference https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837 Added Reference https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb Added Reference https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb Added Reference https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419 Added Reference https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c Added Reference https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af Added Reference https://git.kernel.org/stable/c/f24a58c72a45f4c109f3557a760cc4b60b7a6037