CyberSecBulletin
CVE-2026-63984NVD status: Analyzed

Linux: Out-of-bounds Write

Published Updated By the CyberSecBulletin desk

CVE-2026-63984 is a critical-severity out-of-bounds write vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 75b3680047bf09af8e7e471a7a6ddf2ce5847f56, fd238c51b0fa5390cceca9f1ac5a9ffda8063eed, 3618b34942b76471d044369bfd30d58c39068bf1 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.51% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 75b3680047bf09af8e7e471a7a6ddf2ce5847f56 or fd238c51b0fa5390cceca9f1ac5a9ffda8063eed or 3618b34942b76471d044369bfd30d58c39068bf1 or 97e06791368c01f0ad2a4b3269c2abe19485ca32, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, 75b3680047bf09af8e7e471a7a6ddf2ce5847f56; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, fd238c51b0fa5390cceca9f1ac5a9ffda8063eed; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, 3618b34942b76471d044369bfd30d58c39068bf1; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, 97e06791368c01f0ad2a4b3269c2abe19485ca32; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, de02fc049352af5a9595f015511222d0a85c326b; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, 6fe1cb312038516cb4d9fa089d700af7059f1a64; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, c0487a9c1e116cf349e2d1f302d9019670460858; 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 up to, but not including, 9d5e7a46a9f6d8f503b41bfefef70659845f1679; and 1 more ranges75b3680047bf09af8e7e471a7a6ddf2ce5847f56, fd238c51b0fa5390cceca9f1ac5a9ffda8063eed, 3618b34942b76471d044369bfd30d58c39068bf1, 97e06791368c01f0ad2a4b3269c2abe19485ca32, de02fc049352af5a9595f015511222d0a85c326b, 6fe1cb312038516cb4d9fa089d700af7059f1a64
LinuxLinux Kernel5.7 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.

More Out-of-bounds Write vulnerabilities (CWE-787)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Write vulnerabilities

Spotted an error? Tell us.