CVE-2026-63870

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom.

In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected Products

Product	Versions
LinuxLinux	4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before af07fffbd53ddc3ec3c2a4ca914f27899fa89bcaAffected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 3150e6d3223dfc356308125cabf9c34169842d2aAffected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 8da95cb6ad7d656c871e776a9c7b77e894d6d89cAffected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 1a827b95e62b4cbe851ae7cc9c961cdfa769cca4Affected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before c1819c8defa235c7beda859bc185b1c429a55ecdAffected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 285b0842f2e01c3edf805f1fd64da11d9b7f6b4cAffected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 87172cc8dc49aaf54407a31edffb0232f8cb93abAffected 4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3Affected
LinuxLinux	4.0Affected before 4.0Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before af07fffbd53ddc3ec3c2a4ca914f27899fa89bcaAffected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 3150e6d3223dfc356308125cabf9c34169842d2aAffected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 8da95cb6ad7d656c871e776a9c7b77e894d6d89cAffected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 1a827b95e62b4cbe851ae7cc9c961cdfa769cca4Affected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before c1819c8defa235c7beda859bc185b1c429a55ecdAffected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 285b0842f2e01c3edf805f1fd64da11d9b7f6b4cAffected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 87172cc8dc49aaf54407a31edffb0232f8cb93abAffected
4dc315e267fe4a3c863fec21f26aa0a418c3f07a to before 3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3Affected

LinuxLinux

4.0Affected
before 4.0Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.