CVE-2026-63984
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 30, 2026, 2:51 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply the patch for the IPv6 RPL hdrlen overflow.
- Verify the updated kernel configuration.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63984.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63984 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63984
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63984 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63984 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '75b3680047bf09af8e7e471a7a6ddf2ce5847f56', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': 'fd238c51b0fa5390cceca9f1ac5a9ffda8063eed', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '3618b34942b76471d044369bfd30d58c39068bf1', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '97e06791368c01f0ad2a4b3269c2abe19485ca32', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': 'de02fc049352af5a9595f015511222d0a85c326b', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '6fe1cb312038516cb4d9fa089d700af7059f1a64', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': 'c0487a9c1e116cf349e2d1f302d9019670460858', 'versionType': 'git'}, {'status': 'affected', 'version': '8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3', 'lessThan': '9d5e7a46a9f6d8f503b41bfefef70659845f1679', 'versionType': 'git'}], 'programFiles': ['net/ipv6/exthdrs.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.7'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.7', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.259', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.210', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.176', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.143', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/exthdrs.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment. Added Reference https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1 Added Reference https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64 Added Reference https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56 Added Reference https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32 Added Reference https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679 Added Reference https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858 Added Reference https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b Added Reference https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed