In the Linux kernel, the following vulnerability has been resolved:

ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

ipv6_rpl_srh_decompress() computes:

outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3);

hdrlen is __u8. For n >= 127 the result exceeds 255 and silently
truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):

(128 * 16) >> 3 = 256, truncated to 0 as __u8

The caller in ipv6_rpl_srh_rcv() then places the compressed header
at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8,
but the decompressed region occupies buf[0..2055] (8-byte header
plus 128 full addresses). The compressed header overlaps the
decompressed data, and ipv6_rpl_srh_compress() writes into this
overlap, corrupting the routing header of the forwarded packet.

The existing guard at exthdrs.c:546 checks (n + 1) > 255, which
prevents n+1 from overflowing unsigned char (the segments_left
field), but does not prevent the computed hdrlen from overflowing
__u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not
fit.

Tighten the bound to (n + 1) > 127. This caps n at 126, giving
hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed
header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly
past the decompressed region (buf[0..2039]). No overlap. 127
segments is well beyond any realistic RPL deployment.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < 75b3680047bf09af8e7e471a7a6ddf2ce5847f56
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < fd238c51b0fa5390cceca9f1ac5a9ffda8063eed
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < 3618b34942b76471d044369bfd30d58c39068bf1
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < 97e06791368c01f0ad2a4b3269c2abe19485ca32
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < de02fc049352af5a9595f015511222d0a85c326b
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < 6fe1cb312038516cb4d9fa089d700af7059f1a64
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < c0487a9c1e116cf349e2d1f302d9019670460858
8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 affected < 9d5e7a46a9f6d8f503b41bfefef70659845f1679
Linux Linux affected
Version Status Constraints
5.7 affected —
0 unaffected < 5.7
5.10.259 unaffected ≤ 5.10.*
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.93 unaffected ≤ 6.12.*
6.18.35 unaffected ≤ 6.18.*
7.0.12 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/3618b34942b76471d044369bfd30d58c39068bf1 cve-icon
https://git.kernel.org/stable/c/6fe1cb312038516cb4d9fa089d700af7059f1a64 cve-icon
https://git.kernel.org/stable/c/75b3680047bf09af8e7e471a7a6ddf2ce5847f56 cve-icon
https://git.kernel.org/stable/c/97e06791368c01f0ad2a4b3269c2abe19485ca32 cve-icon
https://git.kernel.org/stable/c/9d5e7a46a9f6d8f503b41bfefef70659845f1679 cve-icon
https://git.kernel.org/stable/c/c0487a9c1e116cf349e2d1f302d9019670460858 cve-icon
https://git.kernel.org/stable/c/de02fc049352af5a9595f015511222d0a85c326b cve-icon
https://git.kernel.org/stable/c/fd238c51b0fa5390cceca9f1ac5a9ffda8063eed cve-icon
History

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 19 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.
Title ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-20T13:42:04.995Z

Reserved: 2026-07-19T07:54:57.025Z

Link: CVE-2026-63984

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.