{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63922", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.021Z", "datePublished": "2026-07-19T14:55:24.268Z", "dateUpdated": "2026-08-05T12:37:16.967Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:16.967Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv \u2192 ip6_input \u2192 ip6_protocol_deliver_rcu \u2192 ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel\u2019s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/exthdrs.c"], "versions": [{"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "b3ac54e5c905f86d22b502eacb5686a282c5659f", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "f8aabed3ff3e986920cf02a2a2785e08e586b234", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "12d957979e4a800167842f1b42be6a606d227ebe", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "ff375ed1cba81392346c5bfbf0bb7a13b2946f99", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "751db1b802a067b7fff25880f4e9f9152a171538", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "9b6dcc0a39fd71752937f0b6b3973e1416085dcf", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "f7b52afe3592eae66e160586b45a3f2242972c63", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/exthdrs.c"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"}, {"url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"}, {"url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"}, {"url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"}, {"url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"}, {"url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"}, {"url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"}, {"url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"}], "title": "ipv6: exthdrs: refresh nh after handling HAO option", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/exthdrs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b3ac54e5c905f86d22b502eacb5686a282c5659f", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "f8aabed3ff3e986920cf02a2a2785e08e586b234", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "12d957979e4a800167842f1b42be6a606d227ebe", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "ff375ed1cba81392346c5bfbf0bb7a13b2946f99", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "751db1b802a067b7fff25880f4e9f9152a171538", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "9b6dcc0a39fd71752937f0b6b3973e1416085dcf", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}, {"lessThan": "f7b52afe3592eae66e160586b45a3f2242972c63", "status": "affected", "version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/exthdrs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage."}], "id": "CVE-2026-63922", "lastModified": "2026-07-28T14:16:39.443", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:10.440", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: ipv6: exthdrs: refresh nh after handling HAO option", "id": "2502327", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502327"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option (HAO), the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value (TLV) options, potentially causing unexpected network behavior or a denial of service."], "name": "CVE-2026-63922", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63922\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63922\nhttps://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63922-5716@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,f8aabed3ff3e986920cf02a2a2785e08e586b234)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,12d957979e4a800167842f1b42be6a606d227ebe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,ff375ed1cba81392346c5bfbf0bb7a13b2946f99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,751db1b802a067b7fff25880f4e9f9152a171538)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,9b6dcc0a39fd71752937f0b6b3973e1416085dcf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,f7b52afe3592eae66e160586b45a3f2242972c63)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T05:00:11.665726+00:00", "updated": "2026-08-05T02:30:03.423901+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}