CVE-2026-63984

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) segment routing header (SRH) decompression function, ipv6_rpl_srh_decompress(). An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate. This truncation leads to an overlap between the compressed header and decompressed data, which can result in the corruption of the routing header in forwarded packets. This vulnerability could allow a remote attacker to cause data corruption.

An integer truncation in the IPv6 RPL SRH decompression path can make hdrlen wrap from 256 to 0 when a crafted header encodes 128 addresses. The caller may then place the compressed header at the wrong offset, causing ipv6_rpl_srh_compress to write into an overlapping part of the decompressed routing header and corrupt the forwarded packet. For the CVSS the PR:N is used because a sender only needs network reachability to an RPL enabled IPv6 path and no local account on the target is required. The issue is network reachable in IPv6 deployments that process RPL source routing headers, but practical exposure is usually limited to specialized RPL or low power routing domains rather than the public Internet. Impact is at least packet integrity corruption and possible denial of service in the forwarding path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.