{"id":14958,"date":"2026-09-04T19:02:19","date_gmt":"2026-09-04T11:02:19","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63920"},"modified":"2026-09-04T19:02:19","modified_gmt":"2026-09-04T11:02:19","slug":"cve-2026-63920","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-63920","title":{"rendered":"CVE-2026-63920 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extens"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ipv6: validate extension header length before copying to cmsg<\/p>\n<p>ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}<br \/>\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the<br \/>\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.<br \/>\nThe length was validated only at parse time (ipv6_parse_hopopts(),<br \/>\netc.).  An nftables payload-write expression can rewrite hdrlen after<br \/>\nparsing and before the skb reaches recvmsg; the write itself is<br \/>\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) &lt;&lt; 3) = 2040<br \/>\nbytes from an 8-byte header.  nftables is reachable from an<br \/>\nunprivileged user namespace, so this is an unprivileged<br \/>\nslab-out-of-bounds read:<\/p>\n<p>  BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac\/0x540<br \/>\n   put_cmsg+0x3ac\/0x540<br \/>\n   udpv6_recvmsg+0xca0\/0x1250<br \/>\n   sock_recvmsg+0xdf\/0x190<br \/>\n   ____sys_recvmsg+0x1b1\/0x620<\/p>\n<p>Add ipv6_get_exthdr_len() which validates that at least two bytes<br \/>\nare accessible before reading the hdrlen field, then checks the<br \/>\ncomputed length against skb_tail_pointer(skb), returning 0 on<br \/>\nfailure.  Extension headers are kept in the linear skb area by<br \/>\npskb_may_pull() during input, so skb_tail_pointer() is the correct<br \/>\nbound.<\/p>\n<p>Use ipv6_get_exthdr_len() at all non-AH call sites: the five<br \/>\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)<br \/>\nand the three standard cases in the extension-header walk loop<br \/>\n(DSTOPTS, ROUTING, default).  AH retains an inline bounds check<br \/>\nbecause its length formula differs ((ptr[1]+2)&lt;&lt;2).<\/p>\n<p>The walk loop also gets a pre-read bounds check at the top to<br \/>\nvalidate ptr before any case accesses ptr[0] or ptr[1].<\/p>\n<p>When the walk loop detects a corrupted header, return from the<br \/>\nfunction instead of continuing to process later socket options.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ipv6: validate extension header length before copying to cmsg<\/p>\n<p>ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14958","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}