{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-63920", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-63920", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-07-19T14:55:22.813Z", "updatedAt": "2026-10-19T20:17:56.265Z", "importedAt": "2026-10-24T01:58:25.636Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "ipv6: validate extension header length before copying to cmsg", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.). An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040\nbytes from an 8-byte header. nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n put_cmsg+0x3ac/0x540\n udpv6_recvmsg+0xca0/0x1250\n sock_recvmsg+0xdf/0x190\n ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure. Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default). AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)<<2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "81394827dfb72772c50d0ae3bdfa094428a5d76d" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "931b4a1f13408c2507719890f78f7227c34a0282" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "08464413e628803bd10cb1df68d0138665f2f885" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "a29768d56eb3798c052ad3281b05596e695a17af" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "0d330eff318c0f44d4fb0ad2c2aef38f87f24c90" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "a35daeabb433686234b010ebf7b53778dbd6c9b8" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "eb18a1b1644e4cad978df2131e2bb9a2e6886992" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "status": "affected", "versionType": "git", "lessThan": "dd433671fef381fdaf7b530c631e6b782d66e224" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "2.6.12" }, { "version": "5.10.259", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.210", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.176", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.143", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.93", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.35", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.0.12", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.0.*" }, { "version": "7.1", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }