Skip to main content

Linux Kernel CVE-2026-63922

| EUVDEUVD-2026-45695 CRITICAL
2026-07-19 Linux GHSA-5w2v-4j6c-44h8
Information Disclosure Linux
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.8 MEDIUM

Network-reachable but requires a cloned-skb reallocation race and active HAO parsing (AC:H); impact is a stale-pointer read causing limited info disclosure (C:L) and possible crash (A:L), no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:21 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:55 cve.org
CRITICAL 9.8
CVE Published
Jul 19, 2026 - 14:55 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option

ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs.

ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head.

This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.

AnalysisAI

Out-of-bounds/stale-pointer read in the Linux kernel's IPv6 extension-header parser (net/ipv6/exthdrs.c) affects systems processing IPv6 Destination Options containing the Home Address Option (HAO). After ipv6_dest_hao() invokes pskb_expand_head() on a cloned skb - which can relocate the packet buffer - ip6_parse_tlv() continues using a stale cached network-header pointer, causing trailing padding/TLVs to be parsed from freed or moved memory. This is an information-disclosure/memory-safety defect (Linux CNA tag: Information Disclosure); there is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not in CISA KEV.

Technical ContextAI

The affected component is the IPv6 Type-Length-Value (TLV) option walker ip6_parse_tlv() in the kernel networking stack. It caches skb_network_header(skb) into a local pointer 'nh' while iterating over IPv6 extension-header options. The Home Address Option handler ipv6_dest_hao() (part of IPv6 Mobility / Mobile IPv6 destination-option processing, present since 2.6.19) may call pskb_expand_head() when the socket buffer is cloned, reallocating the skb head and invalidating any previously derived header pointers. Because 'nh' was not refreshed after that call, subsequent parsing of padding or trailing options dereferences a dangling pointer - a use-of-stale-pointer / out-of-bounds read condition (closest CWE classes: CWE-825 Use of Stale Pointer / CWE-125 Out-of-bounds Read; NVD lists CWE as N/A). The fix re-reads skb_network_header(skb) into 'nh' after ipv6_dest_hao() returns, matching the existing refresh pattern already used elsewhere in the same function after helpers that can move header storage. CPE data (cpe:2.3:a:linux:linux:*) confirms the upstream Linux kernel as the affected product.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, or 7.0.12 (or later within each branch), which add the nh refresh after ipv6_dest_hao(). Apply the patch via your distribution's kernel update channel and reboot (or use live-patching if supported); commits are at https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 and the related stable hashes. If immediate patching is not possible, the practical compensating control is to disable IPv6 Mobility / Home Address Option processing where it is not needed - HAO parsing is only relevant for Mobile IPv6 deployments, which are rare, so most systems can drop or filter inbound IPv6 packets carrying Destination Options with the HAO type at the network edge or via nftables/ip6tables extension-header matching without functional impact. Where IPv6 is entirely unused, disabling IPv6 removes exposure but breaks any IPv6 connectivity, so validate before applying. Reference advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-63922.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63922 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy