Critical 9.8Published Jul 19, 2026

CVE-2026-63984ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

Updated under an hour ago (Oct 28, 2026, 9:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 75b3680047bf09af8e7e471a7a6ddf2ce5847f56; from 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 before fd238c51b0fa5390cceca9f1ac5a9ffda8063eed; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 3618b34942b76471d044369bfd30d58c39068bf1; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 97e06791368c01f0ad2a4b3269c2abe19485ca32; from 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 before de02fc049352af5a9595f015511222d0a85c326b; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 6fe1cb312038516cb4d9fa089d700af7059f1a64; from 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 before c0487a9c1e116cf349e2d1f302d9019670460858; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 builds before 9d5e7a46a9f6d8f503b41bfefef70659845f1679	CNA record

References

References

https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56
https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1
https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32
https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b
https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64
https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858
https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.