{"id":"CVE-2026-63922","title":"ipv6: exthdrs: refresh nh after handling HAO option","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < b3ac54e5c905f86d22b502eacb5686a282c5659f","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f8aabed3ff3e986920cf02a2a2785e08e586b234","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 12d957979e4a800167842f1b42be6a606d227ebe","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < ff375ed1cba81392346c5bfbf0bb7a13b2946f99","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 751db1b802a067b7fff25880f4e9f9152a171538","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 9b6dcc0a39fd71752937f0b6b3973e1416085dcf","Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f7b52afe3592eae66e160586b45a3f2242972c63","Linux 2.6.19"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-16T15:33:28.158927Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:12.026Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63922","references":[{"url":"https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"},{"url":"https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"},{"url":"https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"},{"url":"https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"},{"url":"https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"},{"url":"https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"},{"url":"https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"},{"url":"https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"}],"tags":["cve.org"],"epss":0.00714,"epssPercentile":0.52735,"ingestedAt":"2026-10-16T17:24:46.778Z","slug":"CVE-2026-63922","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage.\n\n## Affected\n\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < b3ac54e5c905f86d22b502eacb5686a282c5659f`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f8aabed3ff3e986920cf02a2a2785e08e586b234`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 12d957979e4a800167842f1b42be6a606d227ebe`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < ff375ed1cba81392346c5bfbf0bb7a13b2946f99`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 751db1b802a067b7fff25880f4e9f9152a171538`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 9b6dcc0a39fd71752937f0b6b3973e1416085dcf`\n- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f7b52afe3592eae66e160586b45a3f2242972c63`\n- `Linux 2.6.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}