CVE-2026-63922 Overview
CVE-2026-63922 is a Linux kernel vulnerability in the IPv6 extension headers (exthdrs) processing code. The flaw resides in ip6_parse_tlv(), which caches the skb_network_header(skb) pointer in a local variable nh while walking IPv6 Type-Length-Value (TLV) options. When ipv6_dest_hao() handles a Home Address Option (HAO) on a cloned skb, it may invoke pskb_expand_head(), relocating the socket buffer head and invalidating the cached pointer. Subsequent TLV parsing then dereferences a stale network header pointer.
Critical Impact
A remote, unauthenticated attacker can send crafted IPv6 packets containing HAO destination options to trigger memory corruption in the kernel network stack.
Affected Products
- Linux kernel (IPv6 subsystem, net/ipv6/exthdrs.c)
- Multiple stable branches referenced by upstream fix commits
- Distributions shipping vulnerable kernel versions prior to backport
Discovery Timeline
- 2026-07-19 - CVE-2026-63922 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63922
Vulnerability Analysis
The vulnerability is a use-of-stale-pointer issue in the Linux kernel IPv6 extension header parser. The function ip6_parse_tlv() iterates through TLV options within an IPv6 Destination Options or Hop-by-Hop header. Before entering the parsing loop, it caches the network header address returned by skb_network_header(skb) into the local variable nh and uses that pointer to compute offsets into TLV data.
One of the option handlers, ipv6_dest_hao(), processes the Home Address Option used by Mobile IPv6. When the incoming skb is cloned, the handler calls pskb_expand_head() to obtain a writable copy of the header area. This allocation moves the underlying buffer to a new location, changing skb->head and, therefore, the value that skb_network_header(skb) would now return. The cached nh pointer, however, still references the freed or reallocated memory region.
After ipv6_dest_hao() returns, the loop continues parsing any trailing padding or additional TLVs using the stale nh, resulting in reads from invalid memory. The fix refreshes nh after the call, matching the existing pattern already applied for other helpers that may modify skb header storage.
Root Cause
The root cause is a failure to reload a cached pointer after invoking a function that can reallocate the underlying buffer. This is a classic stale pointer defect [CWE-825] introduced by an optimization that assumed the network header address remained stable across TLV handler invocations.
Attack Vector
Exploitation requires sending an IPv6 packet with a Destination Options header containing a Home Address Option followed by additional TLVs or padding. The packet must reach a kernel path where the skb is cloned before ip6_parse_tlv() executes. No authentication or user interaction is required, and the attack is delivered over the network.
Because no verified public exploit code is available, technical details are best reviewed in the upstream fix commits, including Linux Kernel Commit 1a11eb7 and Linux Kernel Commit ff375ed.
Detection Methods for CVE-2026-63922
Indicators of Compromise
- Unexpected kernel oops or panic entries in dmesg referencing ip6_parse_tlv, ipv6_dest_hao, or ipv6_parse_hopopts
- Kernel Address Sanitizer (KASAN) reports flagging out-of-bounds reads within IPv6 extension header parsing
- Bursts of IPv6 traffic containing Destination Options headers with Home Address Options from untrusted sources
Detection Strategies
- Monitor kernel logs for repeated crashes or slab-out-of-bounds errors originating in net/ipv6/exthdrs.c
- Deploy network sensors that decode IPv6 extension headers and flag anomalous HAO usage from non-Mobile IPv6 endpoints
- Correlate host-level crash telemetry with inbound IPv6 packet captures to identify triggering flows
Monitoring Recommendations
- Enable auditd and kernel crash reporting on Linux hosts exposed to untrusted IPv6 networks
- Alert on abnormal frequencies of IPv6 packets carrying Destination Options headers, especially with HAO options
- Track kernel version inventory to identify hosts running unpatched builds referenced in the upstream commits
How to Mitigate CVE-2026-63922
Immediate Actions Required
- Apply the stable kernel updates that include the upstream fix commits as soon as vendor packages are available
- Prioritize patching of internet-facing Linux systems processing IPv6 traffic, including routers, load balancers, and edge gateways
- Audit kernel versions across the environment to identify hosts running affected builds
Patch Information
The fix refreshes the nh pointer after ipv6_dest_hao() returns, ensuring TLV parsing always uses the current skb head. Distribution vendors are backporting the change from the following upstream commits: Linux Kernel Commit 12d9579, Linux Kernel Commit 1a11eb7, Linux Kernel Commit 751db1b, Linux Kernel Commit 9b6dcc0, Linux Kernel Commit f7b52af, Linux Kernel Commit f8aabed, and Linux Kernel Commit ff375ed.
Workarounds
- Where Mobile IPv6 functionality is not required, drop IPv6 packets containing the Home Address Option at perimeter firewalls
- Restrict inbound IPv6 Destination Options headers to trusted peers using stateful packet filtering
- If IPv6 is not needed on a host, disable it via sysctl net.ipv6.conf.all.disable_ipv6=1 until patches are applied
# Drop inbound IPv6 packets carrying a Destination Options header with HAO (type 201)
ip6tables -A INPUT -m ipv6header --header dst --soft -j DROP
# Optional: disable IPv6 entirely on hosts that do not require it
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
