CVE-2026-63870: Linux Kernel 6LoWPAN Packet Handling Flaw

CVE-2026-63870 Overview

CVE-2026-63870 is a Linux kernel vulnerability in the IEEE 802.15.4 6LoWPAN subsystem. The flaw resides in the lowpan_xmit() transmit path, which processes non-IPv6 packets using uninitialized lowpan_addr_info data from the socket buffer headroom. When a driver such as aoe queues a non-IPv6 packet (for example ETH_P_AOE) on a 6LoWPAN interface, the header creation function returns early without initializing the address structure. The transmit function then unconditionally reads this uninitialized memory. A similar issue exists in net/bluetooth/6lowpan.c inside bt_xmit(). The patched kernel drops non-IPv6 packets in these paths.

Critical Impact
Local attackers with the ability to send traffic through a 6LoWPAN interface can trigger uninitialized memory use in kernel space, leading to information disclosure, memory corruption, or denial of service.

Affected Products

Linux kernel ieee802154/6lowpan subsystem prior to the fix commits
Linux kernel net/bluetooth/6lowpan.c prior to the fix commits
Distributions shipping vulnerable kernels with 6LoWPAN support enabled

Discovery Timeline

2026-07-19 - CVE-2026-63870 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63870

Vulnerability Analysis

The 6LoWPAN subsystem compresses IPv6 headers for transmission over IEEE 802.15.4 and Bluetooth LE links. The header_ops->create callback (lowpan_header_create or header_create) is responsible for populating a lowpan_addr_info structure inside the skb headroom before transmission. This structure holds source and destination addressing metadata used later during frame construction.

When a non-IPv6 packet reaches a 6LoWPAN interface via dev_queue_xmit(), the header creation function short-circuits and returns without writing to the headroom. The subsequent lowpan_xmit() (or bt_xmit() for Bluetooth) path calls lowpan_header() or setup_header(), which unconditionally reads the lowpan_addr_info structure. The kernel then acts on uninitialized stack or slab memory during frame assembly.

Root Cause

The root cause is missing input validation on the ethernet protocol type in the 6LoWPAN transmit path. The code assumes every packet reaching lowpan_xmit() was previously processed by lowpan_header_create() and therefore has a valid lowpan_addr_info in the skb headroom. This assumption fails when non-IPv6 protocols like ETH_P_AOE are transmitted over a 6LoWPAN interface, resulting in uninitialized memory use in kernel context.

Attack Vector

Exploitation requires local access with the ability to configure or send traffic through a 6LoWPAN network interface. An attacker who can bind a driver such as aoe to a 6LoWPAN device, or otherwise inject non-IPv6 frames via dev_queue_xmit(), can force the kernel to consume uninitialized memory. Depending on the residual contents of the headroom, this can lead to leakage of kernel memory into transmitted frames, memory corruption downstream, or a kernel crash.

No public proof-of-concept has been released and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes referenced below for technical details:

Detection Methods for CVE-2026-63870

Indicators of Compromise

Unexpected kernel warnings or oops messages referencing lowpan_xmit, bt_xmit, lowpan_header, or setup_header.
Presence of non-IPv6 network drivers (for example aoe) bound to 6LoWPAN interfaces on IoT or edge hosts.
Anomalous outbound frames on 6LoWPAN links containing non-zero payloads in fields that should be zero-initialized.

Detection Strategies

Audit loaded kernel modules for ieee802154_6lowpan and bluetooth_6lowpan on systems where 6LoWPAN is not required.
Monitor kernel logs (dmesg, journalctl -k) for KASAN reports flagging uninitialized reads in 6LoWPAN transmit functions.
Enable CONFIG_INIT_STACK_ALL_ZERO or KMSAN in test environments to surface uninitialized memory reads during fuzzing.

Monitoring Recommendations

Track kernel version inventory and flag hosts running kernels prior to the referenced stable fix commits.
Alert on runtime creation of 6LoWPAN interfaces (ip link add type lowpan) on production endpoints.
Log privileged network configuration changes such as binding drivers to unusual link types.

How to Mitigate CVE-2026-63870

Immediate Actions Required

Apply the upstream stable kernel patches referenced above as soon as vendor builds are available.
Blacklist the ieee802154_6lowpan and bluetooth_6lowpan modules on systems that do not use 6LoWPAN.
Restrict CAP_NET_ADMIN to trusted administrators to prevent unprivileged users from creating 6LoWPAN interfaces.

Patch Information

The upstream fix drops non-IPv6 packets in lowpan_xmit() and the equivalent path in net/bluetooth/6lowpan.c bt_xmit(), preventing consumption of uninitialized lowpan_addr_info data. Backports are available across multiple stable branches via the eight commits referenced in the Technical Details section. Consumers should track their distribution's kernel security advisories and install the vendor-provided package that includes these commits.

Workarounds

Unload and blacklist 6LoWPAN modules with modprobe -r ieee802154_6lowpan bluetooth_6lowpan and add entries under /etc/modprobe.d/.
Remove or disable non-IPv6 protocol drivers (such as aoe) from hosts that also expose 6LoWPAN interfaces.
Enforce mandatory access control (SELinux, AppArmor) policies that prevent unprivileged processes from creating or reconfiguring network interfaces.

bash

# Configuration example
echo 'blacklist ieee802154_6lowpan' | sudo tee /etc/modprobe.d/disable-6lowpan.conf
echo 'blacklist bluetooth_6lowpan' | sudo tee -a /etc/modprobe.d/disable-6lowpan.conf
sudo modprobe -r ieee802154_6lowpan bluetooth_6lowpan 2>/dev/null || true
uname -r  # verify running kernel includes the referenced stable fix commits