CVE-2026-63924 Overview
CVE-2026-63924 is a Linux kernel vulnerability in the IPv6 extension headers processing code. The flaw resides in the handling of IPv6 hop-by-hop jumbo payload options. When ipv6_hop_jumbo() calls pskb_trim_rcsum(), the socket buffer (skb) pointers can change, leaving the network header (nh) pointer stale. Subsequent access through the stale pointer creates memory corruption conditions in kernel space. The vulnerability affects Linux kernel IPv6 stack processing and is exploitable over the network without authentication or user interaction.
Critical Impact
A remote attacker can send crafted IPv6 packets with jumbo payload extension headers to trigger memory corruption in the kernel, potentially leading to remote code execution or denial of service.
Affected Products
- Linux kernel (IPv6 subsystem, net/ipv6/exthdrs.c)
- Distributions shipping vulnerable kernel versions prior to the referenced stable commits
- Systems with IPv6 enabled and processing hop-by-hop options
Discovery Timeline
- 2026-07-19 - CVE-2026-63924 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63924
Vulnerability Analysis
The vulnerability exists in the IPv6 extension header parsing logic within the Linux kernel networking stack. Specifically, ipv6_hop_jumbo() processes the jumbo payload option in the hop-by-hop extension header. During processing, the function calls pskb_trim_rcsum(), which may reallocate or modify the underlying socket buffer memory.
After pskb_trim_rcsum() returns, any pointers referencing skb data — including the network header (nh) pointer — may point to freed or reorganized memory. The original code did not refresh the nh pointer, resulting in stale pointer usage. The patch resolves this by recomputing the nh pointer after the trim operation.
This class of bug is categorized as a use-after-free or out-of-bounds access, depending on the exact skb state after trimming. It falls under [CWE-416] Use After Free.
Root Cause
The root cause is failure to refresh cached header pointers after operations that can modify skb layout. Kernel networking code must treat pointers into skb data as invalid after any function that may call skb_pull, pskb_expand_head, or trim operations. The ipv6_hop_jumbo() path violated this invariant.
Attack Vector
An unauthenticated remote attacker can craft an IPv6 packet containing a hop-by-hop extension header with a jumbo payload option that triggers the trim path in ipv6_hop_jumbo(). Because IPv6 hop-by-hop headers are processed on packet reception, no application-level interaction is required. The attack reaches any host with IPv6 enabled and reachable over the network.
No verified public exploit code is available. The vulnerability mechanism is described in the upstream commits referenced by the Linux Kernel Commit #2b56bbd and related backports.
Detection Methods for CVE-2026-63924
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing ipv6_hop_jumbo, ipv6_parse_hopopts, or exthdrs.c in dmesg and /var/log/kern.log
- Kernel address sanitizer (KASAN) reports indicating use-after-free or slab-out-of-bounds in the IPv6 receive path
- Anomalous inbound IPv6 traffic containing hop-by-hop extension headers with jumbo payload options on non-jumbo interfaces
Detection Strategies
- Monitor kernel logs for stack traces originating in net/ipv6/exthdrs.c and correlate with inbound traffic captures
- Enable network telemetry to flag IPv6 packets with hop-by-hop options carrying jumbo payload (option type 0xC2)
- Compare running kernel version against distribution advisories referencing the fix commits
Monitoring Recommendations
- Ingest kernel and syslog events into a centralized logging platform to detect crash patterns across the fleet
- Alert on repeated IPv6 packet parsing errors from the same source addresses
- Track kernel version and patch level as configuration data to identify unpatched hosts
How to Mitigate CVE-2026-63924
Immediate Actions Required
- Apply the kernel update from your Linux distribution that incorporates the upstream fix commits
- Inventory all Linux hosts with IPv6 enabled and prioritize internet-facing systems for patching
- If patching is not immediately possible, restrict inbound IPv6 traffic containing hop-by-hop extension headers at network perimeters
Patch Information
The fix refreshes the nh pointer after ipv6_hop_jumbo() returns. Backports are available across multiple stable kernel branches. Reference commits: Linux Kernel Commit #2b56bbd, Linux Kernel Commit #645b99b, Linux Kernel Commit #72af7be, Linux Kernel Commit #9e883ea, Linux Kernel Commit #b3ac54e, Linux Kernel Commit #bddaa4d, Linux Kernel Commit #c512e1c, and Linux Kernel Commit #d47548a.
Workarounds
- Drop inbound IPv6 packets containing hop-by-hop extension headers at edge firewalls where operationally acceptable
- Disable IPv6 on hosts that do not require it using sysctl net.ipv6.conf.all.disable_ipv6=1
- Use ip6tables rules to filter packets with jumbo payload options until the kernel is patched
# Example: block IPv6 hop-by-hop extension headers at the host
ip6tables -A INPUT -m ipv6header --header hop-by-hop --soft -j DROP
# Verify kernel version against patched builds
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
