In the Linux kernel, the following vulnerability has been resolved:

ipv6: exthdrs: refresh nh after handling HAO option

ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
IPv6 TLVs.

ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can
move the skb head and invalidate the cached network header pointer.
Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs
are parsed from the current skb head.

This matches the existing pattern used in ip6_parse_tlv() after helpers
that can modify skb header storage.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < f8aabed3ff3e986920cf02a2a2785e08e586b234
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < 1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < 12d957979e4a800167842f1b42be6a606d227ebe
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < ff375ed1cba81392346c5bfbf0bb7a13b2946f99
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < 751db1b802a067b7fff25880f4e9f9152a171538
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < 9b6dcc0a39fd71752937f0b6b3973e1416085dcf
a831f5bbc89a9978795504be9e1ff412043f8f77 affected < f7b52afe3592eae66e160586b45a3f2242972c63
Linux Linux affected
Version Status Constraints
2.6.19 affected —
0 unaffected < 2.6.19
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.93 unaffected ≤ 6.12.*
6.18.35 unaffected ≤ 6.18.*
7.0.12 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe cve-icon
https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 cve-icon
https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538 cve-icon
https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf cve-icon
https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63 cve-icon
https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 cve-icon
https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99 cve-icon
History

Sun, 19 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.
Title ipv6: exthdrs: refresh nh after handling HAO option
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T14:55:24.268Z

Reserved: 2026-07-19T07:54:57.021Z

Link: CVE-2026-63922

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.