PT-2026-61239 · Linux · Linux

CVE-2026-63922 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option

ip6 parse tlv() caches skb network header(skb) in nh while walking IPv6 TLVs.

ipv6 dest hao() may call pskb expand head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6 dest hao() returns so any trailing padding or TLVs are parsed from the current skb head.

This matches the existing pattern used in ip6 parse tlv() after helpers that can modify skb header storage.

Correção

Identificadores relacionados

CVE-2026-63922

Produtos afetados

Linux

Referências · 8

• https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe · Nota
• https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 · Nota
• https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538 · Nota
• https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63922 · Nota de Segurança
• https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63 · Nota
• https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf · Nota
• https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99 · Nota