Skip to main content

Linux Kernel CVE-2026-63870

| EUVDEUVD-2026-45555 HIGH
2026-07-19 Linux GHSA-phq6-q8j5-j858
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local-only (AV:L); AC:H because a non-default 6LoWPAN interface plus a non-IPv6-emitting driver are needed; PR:L for interface configuration; impact is uninitialized-memory disclosure (C:H) and crashes (A:H), integrity not meaningfully affected (I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:03 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 16:19 EUVD
CVE Published
Jul 19, 2026 - 14:18 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:18 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom.

In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

AnalysisAI

Use of uninitialized kernel memory in the Linux kernel's IEEE 802.15.4 6LoWPAN transmit path (lowpan_xmit) allows a local attacker to leak or corrupt kernel memory when a non-IPv6 packet (e.g., an ETH_P_AOE frame from the aoe driver) is queued on a 6LoWPAN interface. Because the 6LoWPAN header_create path skips initialization for non-IPv6 traffic, lowpan_xmit unconditionally reads a stale lowpan_addr_info structure from the skb headroom, yielding information disclosure and potential instability (tagged Information Disclosure). No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the issue is not in CISA KEV.

Technical ContextAI

The flaw lives in net/ieee802154/6lowpan (with an analogous issue called out in net/bluetooth/6lowpan.c bt_xmit). 6LoWPAN is the IPv6-over-Low-power-Wireless-Personal-Area-Networks adaptation layer used to carry IPv6 across constrained IEEE 802.15.4 radios. The kernel's header_ops->create implementation (lowpan_header_create / header_create) is written to populate a lowpan_addr_info structure into the skb's reserved headroom only for IPv6 packets; for any other EtherType it returns early. The transmit routine (lowpan_header / setup_header called from lowpan_xmit) then reads that headroom unconditionally. When a non-IPv6 frame is routed to the interface, the addr_info is never written, so the transmit code consumes uninitialized stack/heap-adjacent headroom bytes - the classic CWE-457/CWE-908 (Use of Uninitialized Resource) root cause. The CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, and the fix simply drops non-IPv6 packets at xmit.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, or 7.0.13 (fix also in 7.1) - or apply your distribution's backport of the corresponding git.kernel.org/stable commits (e.g., https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca). Because exploitation depends on the 6LoWPAN adaptation layer, an effective compensating control where patching must be deferred is to not load or to blacklist the relevant kernel modules (e.g., ieee802154_6lowpan / 6lowpan and the bluetooth 6lowpan path) and to avoid creating 6LoWPAN interfaces; the trade-off is loss of IPv6-over-802.15.4 / Bluetooth LE IoT connectivity, which is acceptable on systems that do not use it. Additionally, avoid binding non-IPv6-generating drivers such as aoe onto any 6LoWPAN interface, and restrict CAP_NET_ADMIN so untrusted local users cannot configure such interfaces. These controls only reduce exposure - the definitive fix is the kernel upgrade.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63870 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy