Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to trigger a system crash or potentially access sensitive information. The issue occurs when the system attempts to process certain types of non-standard network traffic on low-power wireless interfaces (6LoWPAN). This could lead to operational disruptions or unauthorized data exposure on affected devices.
Technical details
A vulnerability exists in the Linux kernel's ieee802154 6LoWPAN implementation within the lowpan_xmit() and bt_xmit() functions. When a non-IPv6 packet (such as an ATA over Ethernet packet) is queued for transmission on a 6LoWPAN interface, the header creation function returns early without initializing the lowpan_addr_info structure. Subsequent calls to lowpan_header or setup_header unconditionally copy and use this uninitialized data from the skb headroom. This is a classic use of uninitialized memory vulnerability that can be triggered locally by a user or test case configuring a 6LoWPAN interface. The fix involves explicitly dropping non-IPv6 packets in the transmission path.
Affected products
- Linux Linux Kernel 4.0 to 6.13
Timeline
- 2026-06-03: patched: Initial patch authored by Eric Dumazet
- 2026-07-19: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/1a827b95e62b4cbe851ae7cc9c961cdfa769cca4
- https://git.kernel.org/stable/c/285b0842f2e01c3edf805f1fd64da11d9b7f6b4c
- https://git.kernel.org/stable/c/3150e6d3223dfc356308125cabf9c34169842d2a
- https://git.kernel.org/stable/c/3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3
- https://git.kernel.org/stable/c/87172cc8dc49aaf54407a31edffb0232f8cb93ab
- https://git.kernel.org/stable/c/8da95cb6ad7d656c871e776a9c7b77e894d6d89c
- https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca