PT-2026-61187 · Linux · Linux

CVE-2026-63870 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: 6lowpan: only accept IPv6 packets in lowpan xmit()

The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH P AOE) and queues it for transmission via dev queue xmit() on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header ops->create function (lowpan header create or header create) returns early without initializing the lowpan addr info structure in the skb headroom.

In the transmit function (lowpan xmit), the driver calls lowpan header (or setup header) which unconditionally copies and uses the lowpan addr info from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt xmit().

Correção

Identificadores relacionados

CVE-2026-63870

Produtos afetados

Linux

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63870 · Nota de Segurança
• https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca · Nota
• https://git.kernel.org/stable/c/8da95cb6ad7d656c871e776a9c7b77e894d6d89c · Nota
• https://git.kernel.org/stable/c/87172cc8dc49aaf54407a31edffb0232f8cb93ab · Nota
• https://git.kernel.org/stable/c/285b0842f2e01c3edf805f1fd64da11d9b7f6b4c · Nota
• https://git.kernel.org/stable/c/c1819c8defa235c7beda859bc185b1c429a55ecd · Nota
• https://git.kernel.org/stable/c/1a827b95e62b4cbe851ae7cc9c961cdfa769cca4 · Nota
• https://git.kernel.org/stable/c/3150e6d3223dfc356308125cabf9c34169842d2a · Nota
• https://git.kernel.org/stable/c/3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3 · Nota