CVE-2026-63922
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In the Linux kernel, a vulnerability was found in ip6_parse_tlv() for IPv6, where the cached nh pointer may be invalidated by pskb_expand_head() in ipv6_dest_hao(). After handling the HAO option, the pointer is not refreshed, causing parsing of stale header data.
Risk Assessment
An attacker could exploit this vulnerability to cause parsing errors in IPv6 packets, potentially leading to system crashes (kernel panic) or incorrect network stack behavior.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit refreshing nh after ipv6_dest_hao()).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.