CVE-2026-53263: Linux Kernel Information Disclosure Flaw

CVE-2026-53263 Overview

CVE-2026-53263 is an off-by-one error in the Linux kernel's 6lowpan (IPv6 over Low-Power Wireless Personal Area Networks) implementation. The flaw resides in lowpan_iphc_mcast_ctx_addr_compress(), where incorrect buffer offsets are used during multicast context address compression. The bug produces two distinct issues: corruption of the Reserved Interface Identifier (RIID) field in the compressed multicast address, and transmission of uninitialized kernel stack memory over the network. The kernel maintainers have committed a fix that corrects the offsets and zero-initializes the data array as a defensive measure.

Critical Impact
The off-by-one results in an information disclosure of kernel stack contents over 6lowpan network links, potentially leaking sensitive memory to attackers within radio range.

Affected Products

Linux kernel branches containing the 6lowpan IPHC (IP Header Compression) implementation in net/6lowpan/
Systems using 6lowpan over IEEE 802.15.4 or Bluetooth Low Energy interfaces
IoT and embedded Linux deployments that enable 6lowpan multicast traffic

Discovery Timeline

2026-06-25 - CVE CVE-2026-53263 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53263

Vulnerability Analysis

The vulnerability is an off-by-one error combined with uninitialized memory disclosure in the Linux kernel 6lowpan subsystem. The function lowpan_iphc_mcast_ctx_addr_compress() is responsible for compressing IPv6 multicast addresses according to RFC 6282 IPHC rules when the multicast address matches a stateful context. The compressed inline representation should contain six bytes: two bytes copied from s6_addr[1..2] (encoding flags, scope, and the Reserved Interface Identifier) followed by four bytes from s6_addr[12..15] (the multicast group identifier).

The original implementation correctly placed the first two bytes at data[0..1] but then executed a second memcpy using &data[1] as the destination and &ipaddr->s6_addr[11] as the source. Both offsets were short by one. The decompression peer at lowpan_uncompress_multicast_ctx_daddr() expects the layout data[2..5] = s6_addr[12..15], so the on-wire encoding produced by the sender did not match the format the receiver decoded.

Root Cause

The defect is a classic indexing error [CWE-193 Off-by-one Error] coupled with use of uninitialized stack memory [CWE-908]. Because the second memcpy wrote four bytes starting at data[1] instead of data[2], the byte at data[1] was overwritten with s6_addr[11], corrupting the RIID field. More seriously, data[5] was never assigned. When lowpan_push_hc_data() subsequently emitted the six-byte compressed block onto the wire, the final byte carried whatever residual content existed on the kernel stack at that frame offset.

Attack Vector

An adversary positioned on the same 6lowpan link, typically an IEEE 802.15.4 mesh or BLE personal area network, can passively capture compressed multicast frames emitted by a vulnerable Linux host. Each transmitted multicast packet using context-based compression leaks one byte of kernel stack memory. Over time, repeated observations can accumulate sensitive content such as pointers, credentials, or cryptographic material residing on the stack. The corruption of the RIID field can also cause incorrect address reconstruction at receivers, breaking multicast delivery semantics.

No verified public exploit code is available for CVE-2026-53263. The vulnerability mechanism is documented in the upstream kernel commits referenced below. See the Kernel Git Commit 4485d79 and related stable backports for the exact patch hunks.

Detection Methods for CVE-2026-53263

Indicators of Compromise

Anomalous 6lowpan multicast frames where the second inline byte does not match expected RIID values defined by the active multicast context
Receiver-side IPHC decompression failures or malformed IPv6 multicast group identifiers on lowpan0 style interfaces
Repeated radio-layer capture activity near hosts that emit 6lowpan multicast traffic

Detection Strategies

Inventory Linux hosts that load the 6lowpan, ieee802154_6lowpan, or bluetooth_6lowpan kernel modules and compare running kernel versions against the fixed stable branches listed in the kernel.org commits
Compare current kernel build hashes to the patched commits 06ce6fc, 2a58899, 4485d79, c32f30e, da88084, da8cbb6, dcb1bec, and f24a58c to confirm the fix is present
Capture and parse 6lowpan traffic with tools that decode IPHC to validate that compressed multicast addresses round-trip correctly through lowpan_uncompress_multicast_ctx_daddr()

Monitoring Recommendations

Forward kernel logs and module load events from IoT gateways to a centralized analytics platform and alert on use of unpatched 6lowpan modules
Monitor radio interface counters for unexpected multicast traffic volume that could indicate harvesting attempts by a nearby adversary
Track package management events on embedded Linux fleets to confirm rollout of kernel updates that include the upstream fix

How to Mitigate CVE-2026-53263

Immediate Actions Required

Update the Linux kernel to a stable release that includes the upstream fix referenced in the kernel.org commits listed in the references
On systems that do not require 6lowpan, unload the ieee802154_6lowpan and bluetooth_6lowpan modules and blacklist them to remove the vulnerable code path
Restrict physical and radio-layer access to 6lowpan segments so that an attacker cannot passively capture leaked stack bytes

Patch Information

The fix corrects both memcpy offsets so that the destination is &data[2] and the source is &ipaddr->s6_addr[12], and zero-initializes the local data array. Patched commits are available across multiple stable trees: Kernel Git Commit 06ce6fc, Kernel Git Commit 2a58899, Kernel Git Commit 4485d79, Kernel Git Commit c32f30e, Kernel Git Commit da88084, Kernel Git Commit da8cbb6, Kernel Git Commit dcb1bec, and Kernel Git Commit f24a58c.

Workarounds

Disable 6lowpan multicast traffic on affected interfaces where the use case allows unicast-only communication
Prevent automatic loading of vulnerable modules by adding install ieee802154_6lowpan /bin/true and install bluetooth_6lowpan /bin/true entries to modprobe configuration on hosts that do not require these protocols
Segment IoT radio links from sensitive workloads so that any disclosed stack bytes do not contain high-value data

bash

# Configuration example: prevent loading of vulnerable 6lowpan modules
echo 'install ieee802154_6lowpan /bin/true' | sudo tee /etc/modprobe.d/disable-6lowpan.conf
echo 'install bluetooth_6lowpan /bin/true' | sudo tee -a /etc/modprobe.d/disable-6lowpan.conf
sudo rmmod ieee802154_6lowpan 2>/dev/null || true
sudo rmmod bluetooth_6lowpan 2>/dev/null || true
uname -r   # verify the running kernel matches a patched stable release