Linux Kernel EUVD-2026-59247

The affected code is in the Linux kernel netfilter IPv6 match modules that inspect IPv6 extension headers: Authentication Header (ah), Hop-by-Hop options (hbh), and Routing header (rt). These matches confirm the fixed portion of an extension header is present, then read the header's length field to compute the advertised extension-header length used for matching. The defect is a missing/incorrect bounds check: the advertised length could exceed the bytes actually present in the socket buffer (skb). When that happened the match returned false, which netfilter interprets as 'rule did not match' rather than 'malformed - drop.' Because a common firewall intent is a rule that matches these headers and DROPs them, a false return meant the malformed packet fell through to subsequent rules or the default policy. Root cause is an input-validation / improper-length-check class issue (the input lists CWE as N/A; behaviorally it maps to CWE-20 improper input validation, not the 'Authentication Bypass' tag supplied). CPE data identifies only cpe:2.3:a:linux:linux, i.e. the mainline kernel.