SECUFOCUSNOW
Home›CVE index›CVE-2026-63920
Review reviewHigh

CVE-2026-63920

Linux

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), etc.). An nftables payload-write expression can rewrite hdrlen after parsing and before the skb reaches recvmsg; the write itself is in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040...

CVSS
7.1
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), etc.). An nftables payload-write expression can rewrite hdrlen after parsing and before the skb reaches recvmsg; the write itself is in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040...

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 81394827dfb72772c50d0ae3bdfa094428a5d76d, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 931b4a1f13408c2507719890f78f7227c34a0282, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 08464413e628803bd10cb1df68d0138665f2f885, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a29768d56eb3798c052ad3281b05596e695a17af, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0d330eff318c0f44d4fb0ad2c2aef38f87f24c90, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a35daeabb433686234b010ebf7b53778dbd6c9b8, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < eb18a1b1644e4cad978df2131e2bb9a2e6886992, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dd433671fef381fdaf7b530c631e6b782d66e224, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
Not available
CVE-2026-63920 — Linux | SECUFOCUS NOW