{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63922", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.021Z", "datePublished": "2026-07-19T14:55:24.268Z", "dateUpdated": "2026-07-20T13:41:32.124Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:41:32.124Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: exthdrs: refresh nh after handling HAO option\n\nip6_parse_tlv() caches skb_network_header(skb) in nh while walking\nIPv6 TLVs.\n\nipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can\nmove the skb head and invalidate the cached network header pointer.\nRefresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs\nare parsed from the current skb head.\n\nThis matches the existing pattern used in ip6_parse_tlv() after helpers\nthat can modify skb header storage."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/exthdrs.c"], "versions": [{"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "f8aabed3ff3e986920cf02a2a2785e08e586b234", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "12d957979e4a800167842f1b42be6a606d227ebe", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "ff375ed1cba81392346c5bfbf0bb7a13b2946f99", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "751db1b802a067b7fff25880f4e9f9152a171538", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "9b6dcc0a39fd71752937f0b6b3973e1416085dcf", "status": "affected", "versionType": "git"}, {"version": "a831f5bbc89a9978795504be9e1ff412043f8f77", "lessThan": "f7b52afe3592eae66e160586b45a3f2242972c63", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/exthdrs.c"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234"}, {"url": "https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1"}, {"url": "https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe"}, {"url": "https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99"}, {"url": "https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538"}, {"url": "https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf"}, {"url": "https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63"}], "title": "ipv6: exthdrs: refresh nh after handling HAO option", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: ipv6: exthdrs: refresh nh after handling HAO option", "id": "2502327", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502327"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option (HAO), the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value (TLV) options, potentially causing unexpected network behavior or a denial of service."], "name": "CVE-2026-63922", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63922\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63922\nhttps://lore.kernel.org/linux-cve-announce/2026071948-CVE-2026-63922-5716@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,f8aabed3ff3e986920cf02a2a2785e08e586b234)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,12d957979e4a800167842f1b42be6a606d227ebe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,ff375ed1cba81392346c5bfbf0bb7a13b2946f99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,751db1b802a067b7fff25880f4e9f9152a171538)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,9b6dcc0a39fd71752937f0b6b3973e1416085dcf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a831f5bbc89a9978795504be9e1ff412043f8f77,f7b52afe3592eae66e160586b45a3f2242972c63)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T05:00:11.665726+00:00", "updated": "2026-07-22T18:45:02.692552+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416"]}