PT-2026-61239 · Linux · Linux

CVE-2026-63922 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option

ip6 parse tlv() caches skb network header(skb) in nh while walking IPv6 TLVs.

ipv6 dest hao() may call pskb expand head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6 dest hao() returns so any trailing padding or TLVs are parsed from the current skb head.

This matches the existing pattern used in ip6 parse tlv() after helpers that can modify skb header storage.

Fix

Related Identifiers

CVE-2026-63922

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-63922 · Security Note
• https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe · Note
• https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 · Note
• https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538 · Note
• https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 · Note
• https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63 · Note
• https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf · Note
• https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99 · Note