In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps the next segment into ipv6_hdr->daddr, recompresses, then pulls the old header and pushes the new one plus the IPv6 header back. The recompressed header can be larger than the received one when the swap reduces the common-prefix length the segments share with daddr (CmprI=0, CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).
pskb_expand_head() was gated on segments_left == 0, so on earlier segments the push consumed unchecked headroom. Once skb_push() leaves fewer than skb->mac_len bytes in front of data, skb_mac_header_rebuild()'s call to:
skb_set_mac_header(skb, -skb->mac_len);
will store (data - head) - mac_len into the u16 mac_header field, which wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB past skb->head.
A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.
Fix this by expanding the head whenever the remaining room is less than the push size plus mac_len, and request that much extra so the rebuilt MAC header fits afterwards.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-abi-stablelistsUpgrade kernel-cross-headersUpgrade kernel-64k-debug-coreUpgrade libperfUpgrade kernel-64k-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade python3-perfUpgrade rvUpgrade kernel-rtUpgrade perfUpgrade kernel-headersUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernelUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-devel-matchedUpgrade kernel-toolsUpgrade kernel-64k-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-rt-64kUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernel-docUpgrade kernel-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-modulesUpgrade kernel-rt-develUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-rt-64k-develUpgrade kernel-64kUpgrade kernel-rt-debug-modules-extraUpgrade rtlaUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-tools-libsUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-64k-develUpgrade kernel-uki-virtUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-core | Jun 16, 2026 | Jun 11, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perf6.18-debuginfoUpgrade kernel-livepatch-6.18.30-61.116Upgrade perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade python3-perf6.18Upgrade kernel6.18Upgrade kernel6.18-tools-debuginfoUpgrade bpftool6.18Upgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-modules-extraUpgrade perf6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-toolsUpgrade kernel6.18-tools-develUpgrade bpftool6.18-debuginfoUpgrade kernel6.18-headersUpgrade kernel6.18-develUpgrade kernel6.18-debuginfo | Jun 23, 2026 | May 21, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 5, 2026 | Jul 5, 2026 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jun 17, 2026 | May 21, 2026 |
| Rocky_linux | — | Upgrade kernel-devel-matchedUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade libperf-debuginfoUpgrade kernel-tools-libs-develUpgrade perf-debuginfoUpgrade rvUpgrade kernel-debuginfo-common-s390xUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-extraUpgrade kernel-modules-coreUpgrade kernelUpgrade libperfUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rtUpgrade kernel-uki-virtUpgrade kernel-rt-debuginfoUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-coreUpgrade python3-perf-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extra-matchedUpgrade kernel-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debug-modules-coreUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-debug-develUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-coreUpgrade perfUpgrade kernel-rt-modules-extraUpgrade kernel-tools-debuginfoUpgrade rtlaUpgrade kernel-debug-modulesUpgrade kernel-debuginfo | Jun 17, 2026 | Jun 13, 2026 |
| Ubuntu | — | Upgrade linux-image-7.0.0-27-generic-64kUpgrade linux-image-7.0.0-27-realtime-64kUpgrade linux-image-6.17.0-1019-awsUpgrade linux-image-6.8.0-1058-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1107-gkeUpgrade linux-image-6.8.0-1063-gcp-64kUpgrade linux-image-7.0.0-1007-gcpUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-7.0Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-raspi-7.0Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-virtual-5.15Upgrade linux-image-7.0.0-28-genericUpgrade linux-image-aws-64k-6.8Upgrade linux-image-oem-6.17Upgrade linux-image-aws-64k-7.0Upgrade linux-image-fipsUpgrade linux-image-5.15.0-1063-nvidia-tegraUpgrade linux-image-azure-fdeUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-6.8.0-1058-nvidia-lowlatencyUpgrade linux-image-oem-22.04bUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1060-ibmUpgrade linux-image-6.8.0-134-lowlatencyUpgrade linux-image-aws-64k-5.15Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1063-gcpUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1063-nvidia-tegra-rtUpgrade linux-image-7.0.0-1008-awsUpgrade linux-image-6.17.0-1021-azureUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-6.8.0-1058-gkeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-7.0.0-27-genericUpgrade linux-image-azure-cvmUpgrade linux-image-7.0.0-1007-oracle-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-5.15.0-1111-gcpUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-7.0.0-1008-aws-64kUpgrade linux-image-7.0.0-1009-ibmUpgrade linux-image-5.15.0-185-genericUpgrade linux-image-aws-fips-6.8Upgrade linux-image-generic-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-azure-fde-5.15Upgrade linux-image-realtime-7.0Upgrade linux-image-virtual-6.8Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-gcp-6.17Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gcp-5.15Upgrade linux-image-5.15.0-1052-nvidia-tegra-igxUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-oracleUpgrade linux-image-nvidia-64k-6.17Upgrade linux-image-5.15.0-1074-xilinx-zynqmpUpgrade linux-image-7.0.0-1014-raspiUpgrade linux-image-nvidia-6.17Upgrade linux-image-6.8.0-1057-oracleUpgrade linux-image-5.15.0-1116-azureUpgrade linux-image-aws-7.0Upgrade linux-image-aws-fips-5.15Upgrade linux-image-6.8.0-134-fipsUpgrade linux-image-azure-fde-6.17Upgrade linux-image-oem-24.04bUpgrade linux-image-oracle-7.0Upgrade linux-image-6.8.0-1062-azure-fipsUpgrade linux-image-oem-26.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-64k-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1032-xilinxUpgrade linux-image-5.15.0-1116-azure-fipsUpgrade linux-image-aws-64k-6.17Upgrade linux-image-raspi-nolpaeUpgrade linux-image-realtime-64kUpgrade linux-image-oracle-5.15Upgrade linux-image-virtual-hwe-26.04Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-ibm-classicUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1111-aws-64kUpgrade linux-image-gcp-64kUpgrade linux-image-azure-fipsUpgrade linux-image-7.0.0-1013-nvidiaUpgrade linux-image-gcp-6.8Upgrade linux-image-6.17.0-40-generic-64kUpgrade linux-image-6.8.0-1060-raspiUpgrade linux-image-generic-64k-6.8Upgrade linux-image-5.15.0-1111-gcp-fipsUpgrade linux-image-realtimeUpgrade linux-image-awsUpgrade linux-image-oem-24.04cUpgrade linux-image-oracle-6.17Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-ibm-5.15Upgrade linux-image-6.8.0-134-genericUpgrade linux-image-kvmUpgrade linux-image-aws-lts-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.17.0-1017-realtimeUpgrade linux-image-azure-7.0Upgrade linux-image-5.15.0-1110-realtimeUpgrade linux-image-5.15.0-183-lowlatency-64kUpgrade linux-image-gcp-7.0Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1058-nvidia-64kUpgrade linux-image-azure-fde-7.0Upgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-oem-26.04aUpgrade linux-image-oracle-64k-6.17Upgrade linux-image-oem-22.04dUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-7.0Upgrade linux-image-ibmUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-6.17Upgrade linux-image-5.15.0-185-fipsUpgrade linux-image-6.17.0-1026-nvidia-64kUpgrade linux-image-6.8.0-1060-aws-64kUpgrade linux-image-6.8.0-1057-oracle-64kUpgrade linux-image-6.8.1-1055-realtimeUpgrade linux-image-7.0.0-1007-oracleUpgrade linux-image-6.17.0-40-genericUpgrade linux-image-6.17.0-1018-azure-fdeUpgrade linux-image-generic-6.17Upgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-5.15Upgrade linux-image-raspi-realtimeUpgrade linux-image-raspi-6.8Upgrade linux-image-oem-24.04dUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-5.15.0-183-lowlatencyUpgrade linux-image-aws-5.15Upgrade linux-image-6.8.0-1058-gke-64kUpgrade linux-image-virtual-7.0Upgrade linux-image-6.8.0-134-lowlatency-64kUpgrade linux-image-6.8.0-1029-nvidia-tegra-rtUpgrade linux-image-6.17.0-1026-nvidiaUpgrade linux-image-6.17.0-1019-aws-64kUpgrade linux-image-6.17.0-1018-oracle-64kUpgrade linux-image-5.15.0-185-generic-64kUpgrade linux-image-5.15.0-1116-azure-fdeUpgrade linux-image-5.15.0-1106-nvidia-lowlatencyUpgrade linux-image-realtime-6.17Upgrade linux-image-oem-22.04aUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-lowlatency-5.15Upgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-7.0.0-27-realtimeUpgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-7.0.0-28-generic-64kUpgrade linux-image-7.0.0-1013-nvidia-64kUpgrade linux-image-fips-5.15Upgrade linux-image-5.15.0-1105-ibmUpgrade linux-image-generic-64k-7.0Upgrade linux-image-aws-6.17Upgrade linux-image-6.8.0-1058-nvidiaUpgrade linux-image-5.15.0-1111-aws-fipsUpgrade linux-image-5.15.0-1108-oracleUpgrade linux-image-5.15.0-1106-intel-iotgUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-oracle-64k-7.0Upgrade linux-image-oem-7.0Upgrade linux-image-kvm-5.15Upgrade linux-image-ibm-7.0Upgrade linux-image-gkeop-6.8Upgrade linux-image-azure-fips-5.15Upgrade linux-image-azure-6.8Upgrade linux-image-azure-6.17Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.15.0-1103-kvmUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-5.15Upgrade linux-image-oracle-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-raspi-6.17Upgrade linux-image-oem-22.04cUpgrade linux-image-xilinx-6.8Upgrade linux-image-realtime-5.15Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-oem-20.04bUpgrade linux-image-nvidia-hwe-24.04Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-azure-fde-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-134-generic-64kUpgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.17.0-1020-gcpUpgrade linux-image-aws-64kUpgrade linux-image-6.17.0-1018-oracleUpgrade linux-image-5.15.0-1106-nvidiaUpgrade linux-image-azure-fips-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-7.0.0-1014-raspi-realtimeUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-7.0.0-1008-oemUpgrade linux-image-6.8.0-1060-awsUpgrade linux-image-5.15.0-1052-nvidia-tegra-igx-rtUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-5.15Upgrade linux-image-lowlatency-64kUpgrade linux-image-gke-5.15Upgrade linux-image-gkeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1060-aws-fipsUpgrade linux-image-6.8.0-1045-gkeopUpgrade linux-image-7.0.0-1007-gcp-64kUpgrade linux-image-6.8.0-1063-azureUpgrade linux-image-6.17.0-1021-raspiUpgrade linux-image-6.17.0-1020-gcp-64kUpgrade linux-image-5.15.0-185-generic-lpaeUpgrade linux-image-xilinxUpgrade linux-image-virtualUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64k-hwe-24.04Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-lowlatencyUpgrade linux-image-intelUpgrade linux-image-gkeopUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1029-nvidia-tegraUpgrade linux-image-5.15.0-1094-gkeopUpgrade linux-image-6.8.0-1063-gcp-fipsUpgrade linux-image-6.17.0-1028-oemUpgrade linux-image-5.15.0-1111-awsUpgrade linux-image-5.15.0-1105-raspiUpgrade linux-image-5.15.0-1103-intel-iot-realtimeUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-virtual-6.17Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-laptop-23.10Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-2049-raspi-realtimeUpgrade linux-image-6.8.0-136-generic | Jul 1, 2026 | May 21, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 8, 2026 | May 21, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub