CVE-2026-63920: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63920 Overview

CVE-2026-63920 is a slab out-of-bounds read vulnerability in the Linux kernel's IPv6 datagram handling code. The flaw resides in ip6_datagram_recv_specific_ctl(), which constructs IPV6_HOPOPTS, IPV6_DSTOPTS, and IPV6_RTHDR control messages by trusting the on-wire hdrlen byte when computing the put_cmsg() length. An attacker can leverage an nftables payload-write expression to modify hdrlen after parse-time validation but before recvmsg executes. This causes put_cmsg() to read up to 2040 bytes from an 8-byte header. The nftables subsystem is reachable from an unprivileged user namespace, making this an unprivileged local memory disclosure.

Critical Impact
Local unprivileged users can trigger a slab out-of-bounds read in kernel memory, exposing sensitive kernel data and potentially degrading system availability through KASAN-detected corruption.

Affected Products

Linux kernel (upstream) — IPv6 stack in net/ipv6/datagram.c
Distributions shipping affected stable kernel branches referenced in the kernel.org commits
Systems that permit unprivileged user namespaces with nftables access

Discovery Timeline

2026-07-19 - CVE-2026-63920 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63920

Vulnerability Analysis

The vulnerability is an out-of-bounds read in the IPv6 receive control message path. ip6_datagram_recv_specific_ctl() builds IPV6_HOPOPTS, IPV6_DSTOPTS, and IPV6_RTHDR cmsgs, along with their legacy IPV6_2292* counterparts. The function computes the copy length as ((hdrlen + 1) << 3) using the untrusted ptr[1] byte from the packet. That length can reach 2040 bytes while the underlying header may occupy only 8 bytes of the socket buffer.

Extension headers are validated at parse time by helpers such as ipv6_parse_hopopts(). However, the parsed skb data remains mutable through the network filtering path. put_cmsg() later re-reads the raw header without revalidation, copying data past the intended header boundary into the user-provided message buffer.

Root Cause

The root cause is a time-of-check to time-of-use (TOCTOU) condition combined with missing bounds validation before the copy. Extension header length validation occurs during input parsing, but the hdrlen field is read again from the linear skb area at recvmsg time without reverification against skb_tail_pointer(skb). An nftables payload-write expression can rewrite the hdrlen byte between these two operations. The write itself is in-bounds and passes filter validation, yet it invalidates the assumption that the previously parsed length still matches the on-wire value.

Attack Vector

An unprivileged local attacker creates a user namespace and configures an nftables rule containing a payload-write expression targeting the hdrlen field of an IPv6 extension header. The attacker then sends an IPv6 datagram containing HOPOPTS, DSTOPTS, or RTHDR extension headers to a socket they control. The nftables rule rewrites hdrlen to a large value after parsing succeeds. When the receiving process calls recvmsg(), put_cmsg() copies up to 2040 bytes from adjacent slab memory into the returned control message.

KASAN reports the condition as follows:

BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540
 put_cmsg+0x3ac/0x540
 udpv6_recvmsg+0xca0/0x1250
 sock_recvmsg+0xdf/0x190
 ____sys_recvmsg+0x1b1/0x620

The leaked bytes can include kernel heap contents adjacent to the skb linear area, aiding subsequent exploitation such as KASLR defeat or heap layout inference.

Detection Methods for CVE-2026-63920

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds in put_cmsg originating from udpv6_recvmsg or rawv6_recvmsg call paths
Kernel warnings or crashes tied to IPv6 cmsg processing on hosts with unprivileged user namespaces enabled
Unexpected creation of user namespaces followed by nftables rule loading by non-root UIDs

Detection Strategies

Audit nft and nfnetlink syscalls originating from unprivileged UIDs, correlating with subsequent recvmsg activity on IPv6 sockets
Monitor unshare(CLONE_NEWUSER) and unshare(CLONE_NEWNET) sequences that precede nftables configuration by unprivileged processes
Deploy KASAN-enabled kernels in staging to surface the exact out-of-bounds condition during regression testing

Monitoring Recommendations

Enable kernel audit rules for nft_payload operations and correlate with process user namespace context
Track dmesg output for KASAN, BUG, and stack trace entries mentioning put_cmsg or IPv6 extension header symbols
Alert on processes that combine user namespace creation with raw or UDP IPv6 socket usage under non-privileged accounts

How to Mitigate CVE-2026-63920

Immediate Actions Required

Apply the upstream kernel patches referenced in the kernel.org commits below to all Linux hosts, prioritizing multi-tenant and container workloads
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 where namespaces are not required
Disable nftables access for unprivileged users through seccomp profiles or LSM policies on container hosts

Patch Information

The fix introduces ipv6_get_exthdr_len(), which validates that at least two bytes are accessible before reading hdrlen and checks the computed length against skb_tail_pointer(skb), returning 0 on failure. The helper is applied at all non-AH call sites, including the five standalone cmsg blocks (HbH, 2292HbH, two 2292DSTOPTS, and 2292RTHDR) and the three standard cases in the extension-header walk loop (DSTOPTS, ROUTING, and default). AH retains an inline bounds check because its length formula differs as (ptr[1]+2)<<2. The walk loop also gains a pre-read bounds check and returns from the function on corrupted headers. Refer to the following commits: 08464413e628, 0d330eff318c, 81394827dfb7, 931b4a1f1340, a29768d56eb3, a35daeabb433, dd433671fef3, and eb18a1b1644e.

Workarounds

Set sysctl -w kernel.unprivileged_userns_clone=0 to block unprivileged user namespace creation on distributions that expose the toggle
Use sysctl -w user.max_user_namespaces=0 in mount or PID namespaces where container tooling does not require nested namespaces
Deploy seccomp or AppArmor policies that deny the unshare syscall with CLONE_NEWUSER for untrusted workloads

bash

# Configuration example
# Block unprivileged user namespaces (persistent)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-cve-2026-63920.conf
echo 'user.max_user_namespaces=0' | sudo tee -a /etc/sysctl.d/99-cve-2026-63920.conf
sudo sysctl --system

# Verify current runtime values
sysctl kernel.unprivileged_userns_clone user.max_user_namespaces