What is the CVSS score of CVE-2026-63924?

CVE-2026-63924 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63924?

A critical memory-corruption vulnerability in Linux kernel IPv6 processing (CVE-2026-63924, CVSS 9.8) affects essentially all kernel versions in production globally and is remotely exploitable via…. A patch is available.

How to fix or mitigate CVE-2026-63924?

Within 24 hours, inventory all Linux systems running kernel versions prior to 6.6.143, 6.1.176, 6.12.93, 5.15.210, or 5.10.259 and flag those processing IPv6 traffic as highest priority. Within 7 days, deploy vendor-released kernel patches to all critical-tier production infrastructure (load balancers, DNS, network appliances, and core services) through your standard release channels; patches are available from upstream Linux stable trees and all major distributions (RHEL, Ubuntu, Debian, SLES). Within 30 days, complete patching across all remaining affected Linux systems through normal change-management windows.

Linux Kernel CVE-2026-63924

EUVD-2026-45697 CRITICAL

2026-07-19 Linux

GHSA-4j34-532j-f693

Information Disclosure Linux

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Remote unauthenticated packet delivery keeps AV:N/PR:N/UI:N, but reliance on the jumbogram path and skb-relocation timing makes AC:H; impact is kernel memory read (C:H) and crash (A:H) with no clear integrity write (I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:22 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

CRITICAL 9.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.

AnalysisAI

Memory-corruption/stale-pointer flaw in the Linux kernel's IPv6 extension-header processing (net/ipv6/exthdrs.c) where the network-header pointer is not refreshed after ipv6_hop_jumbo() invokes pskb_trim_rcsum(), which can reallocate or relocate the socket buffer. Affects the IPv6 hop-by-hop jumbogram code path across a very broad range of kernel versions from 2.6.12 onward, and is reachable by remote attackers sending crafted IPv6 packets; NVD scores it CVSS 9.8 but EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. The upstream fix is merged and backported to stable trees (e.g., 6.6.143, 6.1.176, 6.12.93, 5.15.210, 5.10.259).

Technical ContextAI

The bug lives in the Linux IPv6 stack's extension-header parser. When an IPv6 packet carries a Hop-by-Hop Options header containing the Jumbo Payload option (RFC 2675), ipv6_hop_jumbo() is called to validate and process the jumbogram length. That function calls pskb_trim_rcsum(), which may trim the skb and, in doing so, reallocate the linear data area - invalidating any previously cached pointers into the packet. The calling code retained a stale 'nh' (network header) pointer computed before the trim and continued to dereference it, leading to reads/writes against a freed or moved buffer. The affected component is the kernel networking subsystem (CPE cpe:2.3:a:linux:linux:*), and the root-cause class is a use-after-relocation / stale-pointer dereference (functionally CWE-416 use-after-free / CWE-825 use of a stale pointer), though the NVD CWE field is unpopulated (N/A). The vendor tag classifies the impact as Information Disclosure, consistent with out-of-bounds reads of relocated kernel memory.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 6.18.35, 6.12.93, 6.6.143, 6.1.176, 5.15.210, or 5.10.259 (or later mainline 7.x) - via your distribution's kernel update channel, then reboot to load the patched image. The upstream fix simply recomputes the nh pointer after ipv6_hop_jumbo(); commits are published at git.kernel.org/stable/c/72af7beae774e46ed543f3f2f267bf0a141bfcdd and the other stable references. If patching must be delayed on exposed hosts, reduce exposure to the vulnerable path by dropping IPv6 packets carrying Hop-by-Hop Options / Jumbo Payload options at a firewall or edge device where jumbograms are not legitimately needed (trade-off: breaks any real jumbogram use and adds a filtering rule), or disable IPv6 entirely on systems that do not require it (trade-off: loss of IPv6 connectivity). These are compensating controls only; applying the kernel update is the definitive fix. Confirm exact fixed versions against your distribution's advisory before deploying.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63924 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63924

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code