CVE-2026-63924

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

State: Published
Severity: 9.8 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-822 Untrusted Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b3ac54e5c905f86d22b502eacb5686a282c5659fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 645b99b1a185c91a79bdac4c5de0f91b212d64f0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9e883eaa878f4337b5873c706efb5a192364ed18Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bddaa4dfc7f36e1ee343a0622f69288af2b9ace9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 72af7beae774e46ed543f3f2f267bf0a141bfcddAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c512e1c819dfbf6ae95ee7a44b65b9ad98979157Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2b56bbd928c030894c270cd33d60286326919458Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d47548a36639095939f4747d4c43f2271366f565Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b3ac54e5c905f86d22b502eacb5686a282c5659fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 645b99b1a185c91a79bdac4c5de0f91b212d64f0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9e883eaa878f4337b5873c706efb5a192364ed18Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bddaa4dfc7f36e1ee343a0622f69288af2b9ace9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 72af7beae774e46ed543f3f2f267bf0a141bfcddAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c512e1c819dfbf6ae95ee7a44b65b9ad98979157Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2b56bbd928c030894c270cd33d60286326919458Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d47548a36639095939f4747d4c43f2271366f565Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.