---
id: CVE-2026-63922
title: 'ipv6: exthdrs: refresh nh after handling HAO option'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv6: exthdrs: refresh nh after handling HAO option

  ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
  IPv6 TLVs.

  ipv6_dest_hao() may call pskb_expand…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    b3ac54e5c905f86d22b502eacb5686a282c5659f
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    f8aabed3ff3e986920cf02a2a2785e08e586b234
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    12d957979e4a800167842f1b42be6a606d227ebe
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    ff375ed1cba81392346c5bfbf0bb7a13b2946f99
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    751db1b802a067b7fff25880f4e9f9152a171538
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    9b6dcc0a39fd71752937f0b6b3973e1416085dcf
  - >-
    Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 <
    f7b52afe3592eae66e160586b45a3f2242972c63
  - Linux 2.6.19
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:33:28.158927Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:12.026Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63922'
references:
  - url: 'https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f'
  - url: 'https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234'
  - url: 'https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1'
  - url: 'https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe'
  - url: 'https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99'
  - url: 'https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538'
  - url: 'https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf'
  - url: 'https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63'
tags:
  - cve.org
epss: 0.00714
epssPercentile: 0.52735
ingestedAt: '2026-10-16T17:24:46.778Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option

ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
IPv6 TLVs.

ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can
move the skb head and invalidate the cached network header pointer.
Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs
are parsed from the current skb head.

This matches the existing pattern used in ip6_parse_tlv() after helpers
that can modify skb header storage.

## Affected

- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < b3ac54e5c905f86d22b502eacb5686a282c5659f`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f8aabed3ff3e986920cf02a2a2785e08e586b234`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 12d957979e4a800167842f1b42be6a606d227ebe`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < ff375ed1cba81392346c5bfbf0bb7a13b2946f99`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 751db1b802a067b7fff25880f4e9f9152a171538`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 9b6dcc0a39fd71752937f0b6b3973e1416085dcf`
- `Linux >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f7b52afe3592eae66e160586b45a3f2242972c63`
- `Linux 2.6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.