9.8
CRITICAL CVSS 3.1
CVE-2026-63984
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.

INFO

Published Date :

July 19, 2026, 4:17 p.m.

Last Modified :

July 30, 2026, 2:51 p.m.

Remotely Exploit :

Yes !

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-63984 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix an integer overflow vulnerability in the kernel's IPv6 RPL handling.
  • Update the Linux kernel to the latest version.
  • Apply the patch for the IPv6 RPL hdrlen overflow.
  • Verify the updated kernel configuration.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-63984 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-63984 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-63984 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-63984 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 20, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 19, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '75b3680047bf09af8e7e471a7a6ddf2ce5847f56', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': 'fd238c51b0fa5390cceca9f1ac5a9ffda8063eed', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '3618b34942b76471d044369bfd30d58c39068bf1', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '97e06791368c01f0ad2a4b3269c2abe19485ca32', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': 'de02fc049352af5a9595f015511222d0a85c326b', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '6fe1cb312038516cb4d9fa089d700af7059f1a64', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': 'c0487a9c1e116cf349e2d1f302d9019670460858', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '9d5e7a46a9f6d8f503b41bfefef70659845f1679', 'versionType': 'git'}], 'programFiles': ['net/ipv6/exthdrs.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/exthdrs.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
    Added Reference https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1
    Added Reference https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64
    Added Reference https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56
    Added Reference https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32
    Added Reference https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679
    Added Reference https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858
    Added Reference https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b
    Added Reference https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.