CVE-2026-63922
published 2026-07-19CVE-2026-63922: In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches…
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.69%
49.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh after handling HAO option
ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
IPv6 TLVs.
ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can
move the skb head and invalidate the cached network header pointer.
Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs
are parsed from the current skb head.
This matches the existing pattern used in ip6_parse_tlv() after helpers
that can modify skb header storage.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < b3ac54e5c905f86d22b502eacb5686a282c5659f | b3ac54e5c905f86d22b502eacb5686a282c5659f |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f8aabed3ff3e986920cf02a2a2785e08e586b234 | f8aabed3ff3e986920cf02a2a2785e08e586b234 |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 | 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 12d957979e4a800167842f1b42be6a606d227ebe | 12d957979e4a800167842f1b42be6a606d227ebe |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < ff375ed1cba81392346c5bfbf0bb7a13b2946f99 | ff375ed1cba81392346c5bfbf0bb7a13b2946f99 |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 751db1b802a067b7fff25880f4e9f9152a171538 | 751db1b802a067b7fff25880f4e9f9152a171538 |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < 9b6dcc0a39fd71752937f0b6b3973e1416085dcf | 9b6dcc0a39fd71752937f0b6b3973e1416085dcf |
| linux | linux | >= a831f5bbc89a9978795504be9e1ff412043f8f77 < f7b52afe3592eae66e160586b45a3f2242972c63 | f7b52afe3592eae66e160586b45a3f2242972c63 |
| linux | linux_kernel | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-fde | — | — |
| ubuntu | linux-ibm | — | — |
| ubuntu | linux-oracle | — | — |
| ubuntu | linux-raspi | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs.
ghsa_unreviewed·2026-07-19
CVE-2026-63922 [CRITICAL] In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs.
In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthdrs: refresh nh after handling HAO option
ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
IPv6 TLVs.
ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can
move the skb head and invalidate the cached network header pointer.
Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs
are parsed from the current skb head.
This matches the existing pattern used in ip6_parse_tlv() after helpers
that can modify skb header storage.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 7.0
CVE-2026-64231 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- Cryptographic API;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 archit
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-64107 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platfor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 7.0
CVE-2026-64107 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- x86 platform drivers;
- PSP security protocol;
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer
Red Hat
kernel: ipv6: exthdrs: refresh nh after handling HAO option
vendor_redhat·2026-07-19·CVSS 9.8
CVE-2026-63922 [CRITICAL] CWE-825 kernel: ipv6: exthdrs: refresh nh after handling HAO option
kernel: ipv6: exthdrs: refresh nh after handling HAO option
A flaw was found in the Linux kernel's IPv6 extension header processing. When processing the Home Address Option (HAO), the cached network header pointer may become invalid if the packet's memory is reallocated. This can lead to incorrect parsing of subsequent IPv6 Type-Length-Value (TLV) options, potentially causing unexpected network behavior or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Under investigation
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebehttps://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcfhttps://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659fhttps://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99
2026-07-19
Published