Severity by source
Adjacent network vector for PPP peer; high complexity since PPP session and IPv6CP negotiation must be active; no privileges needed as negotiation occurs pre-auth.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
[Built-in TCP/IP PPP IPV6CP option parsing bounds check]
AnalysisAI
CVE-2026-63626 concerns a bounds-checking deficiency in the built-in TCP/IP stack's PPP (Point-to-Point Protocol) IPV6CP option parsing code in the Linux kernel, as reported by Ubuntu's vendor security team. IPV6CP is the IPv6 Control Protocol negotiated during PPP link establishment; a flaw in parsing its options could allow malformed input to exceed expected memory boundaries. No CVSS score, vector, or CWE classification has been published at time of analysis, leaving severity and exploitability unconfirmed.
Technical ContextAI
PPP (Point-to-Point Protocol) is a data link layer protocol used in dial-up, DSL, and VPN connections. IPV6CP (IPv6 Control Protocol, RFC 5072) is negotiated during PPP link establishment to configure IPv6 over a PPP link. The affected code path is the kernel's built-in TCP/IP PPP implementation, which parses variable-length option fields during LCP/NCP negotiation. A missing or insufficient bounds check when parsing IPV6CP options could allow an option field length value to exceed the actual buffer size. No CWE has been assigned; the most likely root cause class is CWE-125 (Out-of-bounds Read) or CWE-787 (Out-of-bounds Write), but this is not confirmed by the data provided. The Ubuntu vendor team is the sole reporting source; no NVD entry or CPE strings are available.
Affected ProductsAI
The affected component is the built-in TCP/IP PPP IPV6CP option parser within the Linux kernel, as reported by Ubuntu's security team. No specific kernel version range, CPE strings, or Ubuntu package versions have been provided in the available data. Affected systems are those running Linux kernel builds that include the PPP subsystem with IPv6 support enabled and that terminate PPP sessions. Ubuntu users should consult the Ubuntu Security Notices (USN) tracker for package-specific version information as it becomes available.
RemediationAI
No vendor-released patch or specific fix version has been identified in the data available at time of analysis. Ubuntu's security team is the reporting source, so monitoring the Ubuntu Security Notices at ubuntu.com/security/notices is the primary recommended action. As an interim compensating control, administrators who do not require PPP IPv6CP negotiation can disable IPv6 over PPP interfaces or restrict PPP session establishment to trusted peers only. Disabling the ppp kernel module (if PPP connectivity is not operationally required) would eliminate the attack surface entirely but will break PPP-dependent connectivity. No upstream kernel commit or patch reference is available to confirm fix status.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today