Off-by-One Vulnerability in Linux Kernel Multicast Context Address Compression

CVE-2026-53263

What is CVE-2026-53263?

A vulnerability has been identified in the Linux kernel related to the multicast context address compression function, specifically in the lowpan_iphc_mcast_ctx_addr_compress() method. An off-by-one error exists where the memory copying operations do not accurately reference the appropriate memory addresses, leading to potential corruption of the RIID field in compressed multicast addresses. Additionally, because part of the data is not adequately initialized, sensitive uninitialized kernel stack memory may be unintentionally transmitted over the network. Proper remediation requires correcting the data offsets and ensuring the data array is zero-initialized to prevent similar vulnerabilities in the future.

References