Executive brief
A vulnerability in the Linux kernel's 6LoWPAN networking stack could allow sensitive information to be leaked over the network. 6LoWPAN is a protocol used to allow low-power wireless devices to communicate using IPv6. An attacker could potentially capture uninitialized memory from the system's internal stack, which might contain sensitive data from other processes or the kernel itself.
Technical details
An off-by-one error exists in the lowpan_iphc_mcast_ctx_addr_compress() function within net/6lowpan/iphc.c. The second memcpy operation uses incorrect destination and source offsets, resulting in the corruption of the RIID field and leaving the final byte of the data array uninitialized. When this data is subsequently transmitted via lowpan_push_hc_data(), uninitialized kernel stack memory is leaked over the network. The fix involves correcting the buffer offsets and zero-initializing the data array to prevent future information disclosure.
Affected products
- Linux Linux 5609c185f24dffca5f6a9c127106869da150be03 to latest stable
Timeline
- 2026-06-25: advisory: Vulnerability disclosed and patched in stable kernels.
References
- https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b
- https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837
- https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb
- https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb
- https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419
- https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c
- https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af