CVE-2026-63831: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63831 Overview

CVE-2026-63831 is a Linux kernel vulnerability in the mac802154 link-layer security (llsec) subsystem used by IEEE 802.15.4 wireless networking. The affected functions llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() perform in-place cryptographic transformations on socket buffer (skb) data without ensuring the buffer is not shared. This leads to silent data corruption, use-after-free conditions, and kernel crashes under concurrent 802.15.4 traffic with security enabled. The issue was found by 0sec using automated source analysis.

Critical Impact
An adjacent-network attacker sending crafted 802.15.4 frames can trigger slab use-after-free conditions in the Linux kernel, leading to kernel memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel builds with CONFIG_IEEE802154 and mac802154 link-layer security enabled
Systems using 802.15.4 radios such as low-power wireless sensor networks and Thread/Zigbee-adjacent stacks
Distributions shipping vulnerable kernel versions prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-63831 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63831

Vulnerability Analysis

The vulnerability resides in the Linux kernel net/mac802154/llsec.c cryptographic path. The four affected functions build a scatterlist with sg_init_one() pointing into the skb's linear data area, then pass the same scatterlist as both source and destination to the kernel crypto API through calls such as crypto_skcipher_encrypt, crypto_skcipher_decrypt, crypto_aead_encrypt, and crypto_aead_decrypt. This in-place transformation mutates the underlying data buffer directly.

On the receive path, __ieee802154_rx_handle_packet() clones the incoming skb before delivering it to each subscriber through ieee802154_subif_frame(). Cloned skbs share the same underlying data buffer via reference counting. When llsec_do_decrypt() modifies this shared buffer in place, it corrupts data referenced by other clones, which may belong to unrelated sockets or subsystems. The transmit path exhibits similar sharing when skb_cloned() returns true.

Root Cause

The root cause is a missing skb_cow_data() call before performing in-place crypto operations on potentially shared skb data. Other kernel subsystems that perform in-place cryptography, including ESP in net/ipv4/esp4.c and net/ipv6/esp6.c, MACsec in drivers/net/macsec.c, WireGuard in drivers/net/wireguard/receive.c, and TIPC in net/tipc/crypto.c, all invoke skb_cow_data() first to force a private, writable copy of the buffer.

Attack Vector

An attacker within radio range of an 802.15.4 network with link-layer security enabled can transmit frames that trigger the vulnerable decrypt path. Concurrent traffic increases the likelihood of clone sharing, causing the crypto scatterwalk to write through a page already freed by another clone's kfree_skb(). KASAN and KMSAN reports confirm slab-use-after-free conditions under load.

The vulnerability manifests without any authentication requirement. Public patch commits including 3a2b378, 7a831bc, 84a04eb, 86d5313, 993fd67, bd968bd, e28e7fd, and ff976ef document the fix by adding skb_cow_data() before crypto operations. See the Linux Kernel Commit 3a2b378 for the reference implementation.

Detection Methods for CVE-2026-63831

Indicators of Compromise

KASAN or KMSAN kernel logs reporting slab-use-after-free in llsec_do_decrypt_auth, llsec_do_decrypt_unauth, llsec_do_encrypt_auth, or llsec_do_encrypt_unauth
Unexplained kernel oopses or panics on hosts with active 802.15.4 interfaces under concurrent traffic
Corrupted 802.15.4 frame payloads observed by multiple subscribers of the same interface

Detection Strategies

Audit running kernel version against the fixed commits listed in the upstream advisory and confirm the presence of skb_cow_data() in net/mac802154/llsec.c
Enable KASAN on test kernels to surface use-after-free conditions when fuzzing 802.15.4 traffic
Monitor dmesg and syslog for crypto API scatterwalk faults referencing mac802154 symbols

Monitoring Recommendations

Forward kernel logs from IoT gateways and hosts with 802.15.4 hardware to a centralized log platform for detection of oops and KASAN signatures
Alert on repeated ieee802154 subsystem faults or interface resets
Track kernel package versions across the fleet to identify hosts still running vulnerable builds

How to Mitigate CVE-2026-63831

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 3a2b378, 7a831bc, 84a04eb, 86d5313, 993fd67, bd968bd, e28e7fd, and ff976ef or upgrade to a distribution kernel that includes them
Inventory hosts with CONFIG_IEEE802154 enabled and prioritize gateways, sensors, and edge devices exposed to untrusted radio environments
Restrict physical radio proximity where patches cannot be applied immediately

Patch Information

The fix adds skb_cow_data() before every in-place crypto operation in net/mac802154/llsec.c. This guarantees the skb's data area is not shared and copies data into a private buffer when the head is cloned or spans fragments. Reference patches are published on kernel.org, including Linux Kernel Commit 3a2b378, Linux Kernel Commit 7a831bc, Linux Kernel Commit 84a04eb, Linux Kernel Commit 86d5313, Linux Kernel Commit 993fd67, Linux Kernel Commit bd968bd, Linux Kernel Commit e28e7fd, and Linux Kernel Commit ff976ef.

Workarounds

Disable 802.15.4 link-layer security on affected interfaces if the traffic can be protected at a higher layer, understanding this reduces link confidentiality
Unload the mac802154 and ieee802154 modules on systems that do not require 802.15.4 connectivity
Isolate 802.15.4 gateways from other sensitive subsystems to limit blast radius from a kernel compromise

bash

# Verify the running kernel includes the fix and disable 802.15.4 if not required
uname -r
modprobe -r mac802154 ieee802154 2>/dev/null || true
echo 'blacklist mac802154' | sudo tee /etc/modprobe.d/blacklist-mac802154.conf
echo 'blacklist ieee802154' | sudo tee -a /etc/modprobe.d/blacklist-mac802154.conf