{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-63831",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-63831",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-07-19T12:02:24.320Z",
    "updatedAt": "2026-10-19T20:07:49.327Z",
    "importedAt": "2026-10-24T01:58:20.586Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "mac802154: llsec: add skb_cow_data() before in-place crypto",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data.  They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame().  The\ncloned skb shares the same underlying data buffer via reference\ncounting.  When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation.  skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace.  This is the same pattern used by:\n\n  - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n  - MACsec (drivers/net/macsec.c)\n  - WireGuard (drivers/net/wireguard/receive.c)\n  - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n  - Silent data corruption of other skb clones\n  - Use-after-free when the crypto API scatterwalk writes through a\n    page that has already been freed by another clone's kfree_skb()\n  - Kernel crashes under concurrent 802.15.4 traffic with security\n    enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3a2b378b3a9ca75d3518d879148d2ad25b5714a9"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7a831bcd0486788283ef35e396d4282ee01bb0d5"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ff976ef7c39199ebff33c18034636595016db9f0"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e28e7fd34c449028325322a3f5127b92594b7396"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "993fd674fe85d114e6a8d3963033d4fbbc2170a8"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bd968bdd568beacfdf98ec537a87527e85f1d0cf"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "86d531337ea1ba02d9f2bc830d07c683d9bfaade"
            },
            {
              "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
              "status": "affected",
              "versionType": "git",
              "lessThan": "84a04eb5b210643bd67aab81ff805d32f62aa865"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.16",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.16"
            },
            {
              "version": "5.10.260",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.211",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.177",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.144",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.95",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.38",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.3",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}