CVE-2026-63984 - Vulnerability Details

- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

ipv6_rpl_srh_decompress() computes:

outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);

hdrlen is __u8. For n >= 127 the result exceeds 255 and silently
truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):

(128 * 16) >> 3 = 256, truncated to 0 as __u8

The caller in ipv6_rpl_srh_rcv() then places the compressed header
at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8,
but the decompressed region occupies buf[0..2055] (8-byte header
plus 128 full addresses). The compressed header overlaps the
decompressed data, and ipv6_rpl_srh_compress() writes into this
overlap, corrupting the routing header of the forwarded packet.

The existing guard at exthdrs.c:546 checks (n + 1) > 255, which
prevents n+1 from overflowing unsigned char (the segments_left
field), but does not prevent the computed hdrlen from overflowing
__u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not
fit.

Tighten the bound to (n + 1) > 127. This caps n at 126, giving
hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed
header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly
past the decompressed region (buf[0..2039]). No overlap. 127
segments is well beyond any realistic RPL deployment.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An integer overflow occurs in the Linux kernel's IPv6 RPL segment routing logic when computing the hdrlen field in ipv6_rpl_srh_decompress(). The hdrlen value is stored in an 8‑bit unsigned field, and for a segment count of 127 the calculation produces 256, which silently truncates to 0. This causes the decompressed routing header to overlap the buffer used for the compressed header, corrupting kernel memory and potentially leading to a crash.

Affected Systems

The flaw affects all Linux kernel releases that implement IPv6 RPL Segment Routing header decompression. No specific version list is provided, so all current kernels that support ipv6_rpl_srh_decompress() are potentially vulnerable until the patch is applied.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. The EPSS score of <1% suggests a very low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker could exploit the bug by sending a crafted IPv6 packet with too many segments, causing the hdrlen value to overflow and leading to buffer overlap. This can result in memory corruption, kernel crashes, or even arbitrary code execution if an attacker succeeds in manipulating memory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< 75b3680047bf09af8e7e471a7a6ddf2ce5847f56
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< 3618b34942b76471d044369bfd30d58c39068bf1
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< 97e06791368c01f0ad2a4b3269c2abe19485ca32
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< de02fc049352af5a9595f015511222d0a85c326b
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< 6fe1cb312038516cb4d9fa089d700af7059f1a64
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< c0487a9c1e116cf349e2d1f302d9019670460858
`8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3`	affected	< 9d5e7a46a9f6d8f503b41bfefef70659845f1679

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,75b3680047bf09af8e7e471a7a6ddf2ce5847f56)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,fd238c51b0fa5390cceca9f1ac5a9ffda8063eed)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,3618b34942b76471d044369bfd30d58c39068bf1)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,97e06791368c01f0ad2a4b3269c2abe19485ca32)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,de02fc049352af5a9595f015511222d0a85c326b)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,6fe1cb312038516cb4d9fa089d700af7059f1a64)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,c0487a9c1e116cf349e2d1f302d9019670460858)`	affected	generic	—
`[8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3,9d5e7a46a9f6d8f503b41bfefef70659845f1679)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[5.10.259,5.10.*]`	unaffected	generic	—
`[5.15.210,5.15.*]`	unaffected	generic	—
`[6.1.176,6.1.*]`	unaffected	generic	—
`[6.6.143,6.6.*]`	unaffected	generic	—
`[6.12.93,6.12.*]`	unaffected	generic	—
`[6.18.35,6.18.*]`	unaffected	generic	—
`[7.0.12,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel patch that fixes ipv6_rpl_srh_decompress().
If an immediate kernel upgrade is not possible, disable IPv6 RPL segment routing (e.g., set net.ipv6.rpl_disable=1) or configure a firewall to drop SRH packets with more than 126 segments.
Verify that no inter‑domain routers or IPv6‑enabled equipment forwards SRH packets with more than 126 segments to the vulnerable host.

Generated by OpenCVE AI on August 3, 2026 at 01:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00514.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1
https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64
https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56
https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32
https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679
https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858
https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b
https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63984-8dc3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63984
https://www.cve.org/CVERecord?id=CVE-2026-63984

History

Sat, 25 Jul 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-680

Wed, 22 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-680

Wed, 22 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190
References		https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63984-8dc3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63984 https://www.cve.org/CVERecord?id=CVE-2026-63984
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
Title		ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1 https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64 https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56 https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32 https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679 https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858 https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:06.786Z

Updated: 2026-08-05T12:37:52.442Z

Reserved: 2026-07-19T07:54:57.025Z

Link: CVE-2026-63984

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63984 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T02:00:15Z

Weaknesses

CWE-190
Integer Overflow or Wraparound

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object