CVE-2026-63920

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: validate extension header length before copying to cmsg

ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}

cmsgs (and their IPV6_2292* legacy counterparts) by trusting the

on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.

The length was validated only at parse time (ipv6_parse_hopopts(),

etc.). An nftables payload-write expression can rewrite hdrlen after

parsing and before the skb reaches recvmsg; the write itself is

in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040

bytes from an 8-byte header. nftables is reachable from an

unprivileged user namespace, so this is an unprivileged

slab-out-of-bounds read:

BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540

put_cmsg+0x3ac/0x540

udpv6_recvmsg+0xca0/0x1250

sock_recvmsg+0xdf/0x190

____sys_recvmsg+0x1b1/0x620

Add ipv6_get_exthdr_len() which validates that at least two bytes

are accessible before

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References