Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to access sensitive information from the system's memory. By manipulating network packet headers using standard system tools, an attacker can trick the kernel into reading more data than intended. This could lead to the exposure of private data belonging to other processes or the operating system itself.
Technical details
A slab-out-of-bounds read exists in ip6_datagram_recv_specific_ctl() due to insufficient validation of IPv6 extension header lengths. The function trusted the on-wire hdrlen byte (ptr[1]) when computing the length for put_cmsg(). While this length is validated during initial parsing, an nftables payload-write expression can modify the hdrlen after parsing but before the packet reaches recvmsg. Because nftables is accessible from unprivileged user namespaces, a local attacker can trigger a read of up to 2040 bytes from an 8-byte header. The fix introduces ipv6_get_exthdr_len() to validate that the computed header length does not exceed the actual data available in the socket buffer (skb).
Affected products
- Linux Linux Kernel 2.6.12-rc2 to 6.13
Timeline
- 2026-05-23: disclosed: Initial patch submitted by Qi Tang
- 2026-06-19: patched: Patch committed to stable tree
- 2026-07-19: advisory: CVE-2026-63920 published
References
- https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885
- https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90
- https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d
- https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282
- https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af
- https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8
- https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224