CVE-2026-63984: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63984 Overview

CVE-2026-63984 is a Linux kernel vulnerability in the IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) Source Routing Header (SRH) decompression logic. The flaw resides in ipv6_rpl_srh_decompress() within net/ipv6/exthdrs.c, where an 8-bit hdrlen field silently truncates when the segment count reaches or exceeds 127. The truncation causes the compressed routing header to be written into memory that overlaps the decompressed region, corrupting the forwarded packet's routing header. The vulnerability is remotely reachable over the network without authentication or user interaction.

Critical Impact
A remote attacker can send a crafted IPv6 RPL Source Routing Header to trigger a kernel-side memory corruption during packet forwarding, leading to potential remote code execution, kernel memory disclosure, or system crash.

Affected Products

Linux kernel branches containing the IPv6 RPL Source Routing Header implementation in net/ipv6/exthdrs.c
Systems processing or forwarding IPv6 packets with RPL routing headers enabled
Distributions shipping kernels prior to the fixes referenced in commits 3618b34, 6fe1cb3, 75b3680, 97e0679, 9d5e7a4, c0487a9, de02fc0, and fd238c5

Discovery Timeline

2026-07-19 - CVE-2026-63984 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63984

Vulnerability Analysis

The vulnerability is an integer truncation flaw [CWE-197] leading to out-of-bounds memory corruption in the Linux kernel IPv6 RPL handling path. ipv6_rpl_srh_decompress() computes the outbound header length using the expression outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);. The hdrlen field is declared as __u8, restricting values to 0-255.

When n reaches 127, the computation yields (128 * 16) >> 3 = 256, which truncates to 0 when stored in the 8-bit field. The caller in ipv6_rpl_srh_rcv() then positions the compressed header at buf + ((ohdr->hdrlen + 1) << 3), which becomes buf + 8. The decompressed region occupies buf[0..2055], consisting of an 8-byte header plus 128 full IPv6 addresses. The compressed header write overlaps the decompressed data region.

Root Cause

The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents overflow of the segments_left field but fails to guard against overflow of the computed hdrlen value. With cmpri=15, cmpre=15, pad=0, and hdrlen=16, an attacker can construct a header where n=127 passes the check because 128 <= 255, yet the derived hdrlen=256 does not fit in the destination __u8 field.

Attack Vector

An unauthenticated remote attacker crafts an IPv6 packet containing an RPL Source Routing Header with a segment count of 127 and specific compression parameters (cmpri=15, cmpre=15, pad=0). When the vulnerable kernel receives or forwards the packet, ipv6_rpl_srh_compress() writes into the overlapping memory region, corrupting the routing header of the forwarded packet. The corruption occurs in kernel address space and can be leveraged for denial of service or memory corruption primitives. Refer to the upstream patch commit Kernel Patch 3618b34 for the full fix diff.

Detection Methods for CVE-2026-63984

Indicators of Compromise

Unexpected kernel crashes or oops messages referencing ipv6_rpl_srh_rcv or ipv6_rpl_srh_decompress in dmesg or /var/log/kern.log
IPv6 packets received on external interfaces containing RPL routing headers (Routing Type 3) with segment counts approaching 127
Malformed IPv6 routing header fragments observed in packet captures on RPL-enabled network segments
Anomalous forwarded IPv6 traffic showing corrupted routing header fields downstream of Linux routers

Detection Strategies

Deploy IDS/IPS signatures that inspect IPv6 extension headers for RPL Routing Type 3 with segments_left or cmpri/cmpre values consistent with the overflow condition
Monitor kernel telemetry for stack traces originating in net/ipv6/exthdrs.c handling paths
Correlate kernel panic events with inbound IPv6 traffic patterns using centralized log aggregation

Monitoring Recommendations

Enable kernel audit logging for network stack subsystems and forward events to a centralized SIEM for correlation
Capture IPv6 traffic at network boundaries and alert on RPL SRH headers with high segment counts
Track kernel version inventory across the Linux fleet to identify unpatched hosts running network-facing workloads

How to Mitigate CVE-2026-63984

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the vendor advisory commits (3618b34, 6fe1cb3, 75b3680, 97e0679, 9d5e7a4, c0487a9, de02fc0, fd238c5) as soon as vendor-supported builds are available
Prioritize patching of Linux systems that forward IPv6 traffic or expose IPv6 interfaces to untrusted networks
Audit whether the RPL routing header is required for your deployment; disable IPv6 processing on interfaces where it is not needed

Patch Information

The upstream fix tightens the segment count bound from (n + 1) > 255 to (n + 1) > 127, capping n at 126 and yielding hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + 2040, immediately past the decompressed region without overlap. Patch commits are available at Kernel Patch 3618b34, Kernel Patch 6fe1cb3, Kernel Patch 75b3680, Kernel Patch 97e0679, Kernel Patch 9d5e7a4, Kernel Patch c0487a9, Kernel Patch de02fc0, and Kernel Patch fd238c5.

Workarounds

Block inbound IPv6 packets containing Routing Type 3 (RPL) headers at the network perimeter using firewall rules until patches are deployed
Disable IPv6 forwarding on hosts that do not require routing functionality by setting net.ipv6.conf.all.forwarding=0
Restrict IPv6 traffic on untrusted interfaces where RPL is not part of the operational requirements

bash

# Configuration example
# Disable IPv6 forwarding on hosts that do not require it
sysctl -w net.ipv6.conf.all.forwarding=0
sysctl -w net.ipv6.conf.default.forwarding=0

# Persist across reboots
echo 'net.ipv6.conf.all.forwarding=0' >> /etc/sysctl.d/99-cve-2026-63984.conf
echo 'net.ipv6.conf.default.forwarding=0' >> /etc/sysctl.d/99-cve-2026-63984.conf

# Drop inbound IPv6 packets with Routing Type 3 (RPL) headers using ip6tables
ip6tables -I INPUT -m rt --rt-type 3 -j DROP
ip6tables -I FORWARD -m rt --rt-type 3 -j DROP

# Verify installed kernel version against patched builds
uname -r