CVE-2026-63831

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mac802154: llsec: add skb_cow_data() before in-place crypto

llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),

llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform

in-place cryptographic transformations on skb data. They build a

scatterlist with sg_init_one() pointing into the skb's linear data area

and then pass the same scatterlist as both src and dst to the crypto API

(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).

On the RX path, __ieee802154_rx_handle_packet() clones the received skb

before handing it to each subscriber via ieee802154_subif_frame(). The

cloned skb shares the same underlying data buffer via reference

counting. When llsec_do_decrypt() subsequently modifies this shared

buffer in place, it corrupts data that other clones -- potentially

belonging to other sockets or subsystems -- still reference.

On the TX path, similar data sharing can occur when an skb's hea

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References