CVE-2026-63922 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh after handling HAO option
ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs.
ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head.
This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical memory safety issue within the Linux kernel's IPv6 implementation, specifically affecting how extension headers are processed. This flaw exists in the ipv6 subsystem where the kernel handles IPv6 packet processing and extension headers such as the Home Address Option. The issue stems from improper handling of cached network header pointers during the parsing of IPv6 TLVs, creating a potential for memory corruption that could be exploited by remote attackers.
The technical root cause involves the ip6_parse_tlv() function which caches the skb_network_header(skb) value in a local variable named nh while iterating through IPv6 Type-Length-Value headers. When processing the Home Address Option specifically, the ipv6_dest_hao() helper function may invoke pskb_expand_head() on cloned socket buffers. This expansion operation can relocate the entire socket buffer head, invalidating any previously cached network header pointers that were based on the original memory layout. The vulnerability manifests when subsequent TLV parsing operations attempt to use the stale cached pointer rather than the updated current position of the network header.
This particular flaw aligns with CWE-128, which describes "Wrap-around Error" in buffer overflow contexts, and more specifically relates to improper handling of memory management operations during packet processing. The issue demonstrates a classic example of dangling pointer dereference where cached pointers become invalid due to memory reallocation operations. From an operational perspective, this vulnerability could allow attackers to craft specially crafted IPv6 packets that when processed by affected kernels could result in arbitrary code execution or system crashes, presenting a significant security risk for network infrastructure and servers handling IPv6 traffic.
The kernel's existing defensive pattern already addresses similar scenarios through consistent refresh of cached header pointers after functions that may modify the underlying buffer storage. This particular patch implements the same proven approach by ensuring the nh variable is refreshed immediately after ipv6_dest_hao() returns, guaranteeing subsequent TLV parsing operations reference the current valid network header position rather than an invalidated cached value. The fix follows established security practices and aligns with ATT&CK technique T1059 for privilege escalation through kernel exploitation, though the specific vector would be through network-based packet injection rather than direct user interaction. This vulnerability represents a critical concern for systems running affected kernel versions where IPv6 is enabled, particularly in enterprise environments where robust network security is paramount.
The resolution demonstrates proper kernel memory management practices and follows defensive programming principles that prevent similar issues across the codebase. The fix ensures that all header pointer operations remain consistent with the current buffer state regardless of whether intermediate functions have modified the underlying socket buffer structure. This represents a fundamental safeguard against memory corruption vulnerabilities in the network stack, where such issues could potentially allow attackers to escalate privileges or cause denial of service conditions. The patch maintains backward compatibility while strengthening the kernel's resilience against malicious packet injection attacks targeting the IPv6 processing pipeline.