Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could lead to system instability. When processing specific large network packets (Jumbograms), the system may use outdated memory references, potentially causing a crash or unpredictable behavior. This affects the reliability of servers and devices using IPv6.
Technical details
A vulnerability exists in net/ipv6/exthdrs.c within the Linux kernel. The function ipv6_hop_jumbo() calls pskb_trim_rcsum(), which may reallocate or shift the socket buffer (skb), effectively invalidating existing pointers to the network header (nh). If the nh pointer is not refreshed after this call, subsequent kernel operations may perform invalid memory accesses. An attacker could potentially trigger this by sending specially crafted IPv6 Hop-by-Hop options containing Jumbo Payload TLVs. The fix involves recomputing the nh pointer using skb_network_header(skb) immediately after the jumbo packet processing.
Affected products
- Linux Linux Kernel 2.6.12 to 6.10.y
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Justin Iurman
- 2026-06-09: patched: Patch merged into various stable branches
- 2026-07-19: advisory: CVE-2026-63924 published by NVD
References
- https://git.kernel.org/stable/c/2b56bbd928c030894c270cd33d60286326919458
- https://git.kernel.org/stable/c/645b99b1a185c91a79bdac4c5de0f91b212d64f0
- https://git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd
- https://git.kernel.org/stable/c/9e883eaa878f4337b5873c706efb5a192364ed18
- https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f
- https://git.kernel.org/stable/c/bddaa4dfc7f36e1ee343a0622f69288af2b9ace9
- https://git.kernel.org/stable/c/c512e1c819dfbf6ae95ee7a44b65b9ad98979157