CVE-2026-63922

What it actually does

This Linux kernel flaw is a memory-corruption issue in IPv6 extension-header parsing. While processing IPv6 Type-Length-Value options, the kernel caches a pointer to the network header. If a Destination Options header contains a Home Address Option, the helper that processes it can expand or relocate the socket buffer head for cloned packets, invalidating the cached pointer. The parser may then continue reading trailing padding or additional TLVs through a stale pointer. Depending on memory layout and kernel hardening, this can lead to kernel memory corruption, kernel crash, denial of service, or potentially remote code execution in kernel context. The CVSS vector indicates remote, unauthenticated exploitation over the network with no user interaction.

Why it matters to the business

Affected Linux systems that accept IPv6 traffic may be exposed to unauthenticated remote attacks that can crash hosts or, in the worst case, allow compromise at the operating-system kernel level. For businesses, this creates risk of service outages, loss of workload availability, and potential full host compromise for internet-facing or untrusted-network-facing Linux servers, appliances, containers hosts, routers, firewalls, and embedded devices using vulnerable kernels. Although EPSS is currently low and there is no known CISA KEV listing or public exploit maturity reported, the high CVSS score and network-reachable attack surface make remediation important, especially where IPv6 is enabled.

How an attack unfolds

An attacker sends crafted IPv6 packets to a vulnerable Linux system. The packets include IPv6 extension headers, specifically a Destination Options header containing a Home Address Option and additional trailing padding or TLV data. During parsing, the kernel stores a pointer to the IPv6 network header. Processing the Home Address Option may cause the socket buffer head to be reallocated for a cloned packet. If the cached pointer is not refreshed, subsequent parsing uses a stale memory reference. An attacker attempts to shape packet contents, cloning conditions, and heap state so the stale pointer results in controlled memory corruption rather than only a crash. Successful exploitation may cause a kernel panic, denial of service, information exposure, or potentially arbitrary code execution in kernel space. There are no named threat actors or known active exploitation campaigns reported for this issue in the supplied data.

How to fix it

Apply a vendor-supplied Linux kernel update that includes the IPv6 extension-header fix described as refreshing the network-header pointer after handling the Home Address Option in ip6_parse_tlv(). No exact fixed package versions were provided in the input, so use the fixed kernel versions from the relevant Linux distribution, appliance vendor, cloud image provider, or embedded-device vendor. Reboot systems after installing the patched kernel and verify they are running the updated kernel, not merely that the package is installed. If immediate patching is not possible, reduce exposure by disabling IPv6 where it is not required, blocking untrusted IPv6 traffic at network boundaries, and filtering IPv6 extension headers or Mobile IPv6 Home Address Option traffic where operationally safe. Because extension-header filtering can affect legitimate IPv6 behavior, test mitigations before broad deployment.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version and vendor advisory status for each affected Linux distribution or appliance. Where source-level validation is possible, confirm the kernel contains the fix in the IPv6 extension-header parsing path that refreshes the cached network-header pointer after ipv6_dest_hao() returns. Validate that systems have been rebooted into the patched kernel. From an exposure perspective, confirm whether IPv6 is enabled and whether packets containing IPv6 Destination Options headers and Home Address Options can reach the host. Network controls can be tested in a controlled environment by sending benign IPv6 packets with Destination Options and confirming that boundary devices drop or allow them according to policy. Monitor system stability after patching and confirm that prior crash signatures related to IPv6 extension-header parsing no longer occur.

Typical attack path

1. Identify Linux systems reachable over IPv6, especially internet-facing servers, network appliances, routers, firewalls, and container hosts.
2. Confirm that IPv6 traffic and IPv6 extension headers are accepted by the target path.
3. Send crafted IPv6 packets containing Destination Options headers with a Home Address Option.
4. Trigger packet-buffer head expansion or relocation while the kernel is parsing the extension-header TLVs.
5. Cause the parser to continue using an invalid cached network-header pointer.
6. Leverage the resulting stale-pointer access to crash the kernel or attempt more advanced memory-corruption exploitation.
7. If code execution is achieved, run payloads with kernel-level privileges; otherwise, repeat traffic to sustain denial of service.

How to detect it

Detecting prior exploitation is difficult because the vulnerability is triggered by malformed network traffic and may leave only transient packet telemetry or kernel crash artifacts. Review network sensor, firewall, IDS, packet-capture, and flow logs for unusual IPv6 traffic containing Destination Options headers, especially Mobile IPv6 Home Address Options, sent to Linux systems before a crash or reboot. Review host logs for kernel oops, panic, KASAN, slab, page fault, or general protection fault messages involving IPv6 extension-header parsing functions such as ip6_parse_tlv(), ipv6_dest_hao(), ipv6_destopt_rcv(), or related skb manipulation paths. Correlate unexplained Linux reboots, watchdog resets, or kernel panics with inbound IPv6 packets from external or untrusted sources. If full packet capture is available, inspect IPv6 next-header chains for Destination Options header value 60 and Home Address Option type 201 / 0xC9, especially when followed by unusual padding or additional TLVs. Absence of these artifacts does not prove non-exploitation because successful exploitation may not produce reliable application-layer logs.

• ip6_parse_tlv
• ipv6_dest_hao
• ipv6_destopt_rcv
• pskb_expand_head
• RIP: .*ip6_parse_tlv
• RIP: .*ipv6_dest_hao
• BUG: KASAN
• general protection fault
• kernel BUG
• kernel panic
• Oops:
• Destination Options
• Home Address Option
• IPv6 next header 60
• IPv6 option type 201
• IPv6 option type 0xc9

What your security team should do

• Prioritize patching internet-facing and untrusted-network-facing Linux systems with IPv6 enabled.
• Inventory Linux kernels across servers, appliances, cloud images, container hosts, routers, firewalls, and embedded systems; map them to vendor advisories for this issue.
• Reboot after kernel updates and verify the active running kernel is the fixed version.
• Temporarily disable IPv6 on systems that do not require it, following vendor-supported procedures.
• Where feasible, block or restrict IPv6 extension headers and Mobile IPv6 Home Address Option traffic at network perimeters and between untrusted network segments.
• Enable or review kernel crash, panic, and oops logging for signs of attempted exploitation.
• Hunt network telemetry for unusual IPv6 Destination Options traffic, especially packets containing Home Address Option type 0xC9.
• Track exploit maturity and CISA KEV status because this class of network-reachable kernel memory corruption can become urgent if a reliable exploit is published.