Executive brief
A vulnerability in the Linux kernel's 802.15.4 wireless networking protocol (often used in low-power IoT devices) could allow for data corruption or system crashes. The issue occurs when the system processes encrypted network traffic, potentially overwriting memory that is still being used by other parts of the system. This can lead to unpredictable behavior, loss of data integrity, or a complete service outage for affected devices.
Technical details
A vulnerability exists in the mac802154 llsec implementation where in-place cryptographic transformations (encryption/decryption) are performed on shared socket buffers (skbs) without proper copying. In the RX path, the kernel clones received skbs to distribute them to multiple subscribers; because these clones share the same underlying data buffer via reference counting, in-place decryption by one subscriber corrupts the data seen by others. This lack of synchronization leads to silent data corruption, slab-use-after-free conditions when the crypto API writes to pages already freed by other clones, and kernel crashes. The fix introduces skb_cow_data() calls in mac802154_llsec_encrypt and llsec_do_decrypt to ensure the skb data area is private before modification.
Affected products
- Linux Linux Kernel net/mac802154/llsec.c
Timeline
- 2026-05-26: disclosed: Vulnerability reported by 0sec
- 2026-07-04: patched: Fix committed to stable kernel tree
- 2026-07-19: advisory: CVE-2026-63831 published
References
- https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9
- https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5
- https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865
- https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade
- https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8
- https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf
- https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396