CVE-2026-63870 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case).
Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom.
In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data.
Fix this by dropping non IPv6 packets.
A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's 6LoWPAN implementation where the ieee802154 subsystem fails to properly validate packet types before processing them through the 6LoWPAN transmission path. The issue arises when drivers such as the aoe driver generate non-IPv6 packets with Ethernet protocol types like ETH_P_AOE and queue them for transmission via dev_queue_xmit() on 6LoWPAN interfaces. The fundamental flaw occurs in the lowpan_xmit function where the system assumes all packets are IPv6 frames without proper type checking, leading to a critical data corruption scenario.
The technical implementation error stems from the header_ops->create function which returns early for non-IPv6 packets without properly initializing the lowpan_addr_info structure within the socket buffer headroom. This incomplete initialization creates a scenario where uninitialized memory segments remain in the packet metadata area. When the transmission function subsequently calls lowpan_header or setup_header, it unconditionally copies and utilizes this uninitialized lowpan_addr_info data, resulting in unpredictable behavior and potential exploitation vectors.
This vulnerability directly maps to CWE-457: Use of Uninitialized Variable, which is categorized under the broader class of software defects involving improper initialization of data structures. The operational impact of this flaw extends beyond simple data corruption as it can enable attackers to manipulate network packet processing through carefully crafted non-IPv6 packets that bypass normal validation checks. The vulnerability affects 6LoWPAN interfaces specifically configured for IPv6 communication, creating a mismatch between the expected IPv6 packet flow and actual mixed protocol traffic.
The fix implementation requires dropping non-IPv6 packets at the ingress point of the 6LoWPAN transmission path, ensuring that only valid IPv6 frames proceed through the header creation and transmission functions. This approach aligns with defensive programming principles and network protocol validation best practices established in industry standards such as those outlined in the NIST Cybersecurity Framework for secure network communication. The similar vulnerability identified in net/bluetooth/6lowpan.c bt_xmit() function indicates this is a systemic issue within the 6LoWPAN subsystem that requires comprehensive code review and patching across all related transmission functions.
This vulnerability classifies under ATT&CK technique T1059.007 for Command and Scripting Interpreter: Python, though more specifically relates to network protocol manipulation techniques that could be leveraged in privilege escalation scenarios. The fix implementation should be prioritized as a critical security patch since it prevents potential data corruption and memory access violations that could lead to system instability or privilege escalation. Network administrators should ensure immediate deployment of patches that enforce strict IPv6 packet validation on 6LoWPAN interfaces to prevent exploitation of this uninitialized variable vulnerability across wireless sensor network deployments and IoT environments relying on 6LoWPAN protocols for IPv6 communication.