{"id":"CVE-2026-63920","title":"ipv6: validate extension header length before copying to cmsg","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy c…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 81394827dfb72772c50d0ae3bdfa094428a5d76d","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 931b4a1f13408c2507719890f78f7227c34a0282","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 08464413e628803bd10cb1df68d0138665f2f885","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a29768d56eb3798c052ad3281b05596e695a17af","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0d330eff318c0f44d4fb0ad2c2aef38f87f24c90","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a35daeabb433686234b010ebf7b53778dbd6c9b8","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < eb18a1b1644e4cad978df2131e2bb9a2e6886992","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dd433671fef381fdaf7b530c631e6b782d66e224","Linux 2.6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:33:23.448048Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:11.708Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63920","references":[{"url":"https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d"},{"url":"https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282"},{"url":"https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885"},{"url":"https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af"},{"url":"https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90"},{"url":"https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8"},{"url":"https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992"},{"url":"https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224"}],"tags":["cve.org"],"epss":0.00171,"epssPercentile":0.06058,"ingestedAt":"2026-10-16T17:24:46.775Z","slug":"CVE-2026-63920","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.).  An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040\nbytes from an 8-byte header.  nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n  BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n   put_cmsg+0x3ac/0x540\n   udpv6_recvmsg+0xca0/0x1250\n   sock_recvmsg+0xdf/0x190\n   ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure.  Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default).  AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)<<2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 81394827dfb72772c50d0ae3bdfa094428a5d76d`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 931b4a1f13408c2507719890f78f7227c34a0282`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 08464413e628803bd10cb1df68d0138665f2f885`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a29768d56eb3798c052ad3281b05596e695a17af`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0d330eff318c0f44d4fb0ad2c2aef38f87f24c90`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a35daeabb433686234b010ebf7b53778dbd6c9b8`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < eb18a1b1644e4cad978df2131e2bb9a2e6886992`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dd433671fef381fdaf7b530c631e6b782d66e224`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}