CVE-2026-63922

ipv6: exthdrs: refresh nh after handling HAO option

State: Published
Severity: 9.8 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option

ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs.

ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head.

This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	a831f5bbc89a9978795504be9e1ff412043f8f77 to before b3ac54e5c905f86d22b502eacb5686a282c5659fAffected a831f5bbc89a9978795504be9e1ff412043f8f77 to before f8aabed3ff3e986920cf02a2a2785e08e586b234Affected a831f5bbc89a9978795504be9e1ff412043f8f77 to before 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1Affected a831f5bbc89a9978795504be9e1ff412043f8f77 to before 12d957979e4a800167842f1b42be6a606d227ebeAffected a831f5bbc89a9978795504be9e1ff412043f8f77 to before ff375ed1cba81392346c5bfbf0bb7a13b2946f99Affected a831f5bbc89a9978795504be9e1ff412043f8f77 to before 751db1b802a067b7fff25880f4e9f9152a171538Affected a831f5bbc89a9978795504be9e1ff412043f8f77 to before 9b6dcc0a39fd71752937f0b6b3973e1416085dcfAffected a831f5bbc89a9978795504be9e1ff412043f8f77 to before f7b52afe3592eae66e160586b45a3f2242972c63Affected
LinuxLinux	2.6.19Affected before 2.6.19Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

a831f5bbc89a9978795504be9e1ff412043f8f77 to before b3ac54e5c905f86d22b502eacb5686a282c5659fAffected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before f8aabed3ff3e986920cf02a2a2785e08e586b234Affected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1Affected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before 12d957979e4a800167842f1b42be6a606d227ebeAffected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before ff375ed1cba81392346c5bfbf0bb7a13b2946f99Affected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before 751db1b802a067b7fff25880f4e9f9152a171538Affected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before 9b6dcc0a39fd71752937f0b6b3973e1416085dcfAffected
a831f5bbc89a9978795504be9e1ff412043f8f77 to before f7b52afe3592eae66e160586b45a3f2242972c63Affected

LinuxLinux

2.6.19Affected
before 2.6.19Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.