Executive brief
A vulnerability exists in the Linux kernel's handling of IPv6 routing headers used in certain networking environments. An attacker could send a specially crafted network packet that causes the system to crash or behave unpredictably by overwriting internal memory. This primarily impacts the availability of the affected system, potentially leading to a denial-of-service.
Technical details
An out-of-bounds (OOB) write vulnerability exists in the ipv6_rpl_srh_rcv() function in net/ipv6/exthdrs.c. The issue occurs during the decompression and recompression of RFC 6554 Source Routing Headers (SRH). When a recompressed header becomes larger than the original, the kernel may fail to ensure sufficient headroom in the socket buffer (skb). This leads to an integer wrap-around when calculating the MAC header offset, resulting in a memmove() operation writing data approximately 64KiB past the intended buffer. An attacker can trigger this via a crafted AF_INET6/SOCK_RAW/IPV6_HDRINCL packet. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux kernel versions including 8610c7c6e3bd and fixed in 4babc2d9fda2, 7398ebefbfd4, 8e8be63465a5, 9e6bf146b559, c261d07a8057
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
References
- https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854
- https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b
- https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f
- https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc
- https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37