IPv6 Header Length Overflow in Linux Kernel Network Stack

CVE-2026-63984

What is CVE-2026-63984?

A vulnerability has been identified in the Linux kernel's handling of IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks). Specifically, the ipv6_rpl_srh_decompress() function computes a header length that can exceed the bounds of the __u8 data type when processing certain types of compressed IPv6 headers. This overflow leads to truncation, causing potential corruption of the routing header when forwarding packets. An adjustment to the header length computation has been made to prevent overlaps between compressed and decompressed headers, significantly enhancing the stability and security of routing operations in Linux-based systems.

References