CVE-2026-63984

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

ipv6_rpl_srh_decompress() computes:

outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);

hdrlen is __u8. For n >= 127 the result exceeds 255 and silently

truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):

(128 * 16) >> 3 = 256, truncated to 0 as __u8

The caller in ipv6_rpl_srh_rcv() then places the compressed header

at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8,

but the decompressed region occupies buf[0..2055] (8-byte header

plus 128 full addresses). The compressed header overlaps the

decompressed data, and ipv6_rpl_srh_compress() writes into this

overlap, corrupting the routing header of the forwarded packet.

The existing guard at exthdrs.c:546 checks (n + 1) > 255, which

prevents n+1 from overflowing unsigned char (the segments_left

field), but does not prevent the computed hdrlen from overflowing

__u8.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References