CVE-2026-63870

A flaw was found in the Linux kernel's 6LoWPAN (IPv6 over Low-Power Wireless Personal Area Networks) module. When a non-IPv6 packet is transmitted over a 6LoWPAN interface, the system attempts to process uninitialized data. This can lead to system instability or a denial of service, making the system unresponsive.

The 6LoWPAN transmit path can use uninitialized lowpan_addr_info when a non IPv6 skb is queued to a 6LoWPAN interface. The header creation path may return without initializing this metadata, while lowpan_xmit() later treats it as valid input for header construction. This is primarily a local or locally configured network stack issue rather than a directly remote packet processing flaw. For the CVSS the PR:L is used because triggering requires a local process or delegated capability able to inject or route a non IPv6 packet through the 6LoWPAN transmit path. Impact is at least a local denial of service or malformed transmit behavior, with possible limited confidentiality impact if uninitialized kernel data is copied into an outgoing frame.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.