CVE-2026-63831

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description In the Linux kernel, the mac802154 module performs in-place cryptographic transformations on socket buffer (skb) data using the functions llsec do encrypt unauth(), llsec do encrypt auth(), llsec do decrypt unauth(), and llsec do decrypt auth(). These functions use sg init one() to create a scatterlist pointing to the skb linear data area, passing it as both source and destination to the crypto API.

On the RX path, ieee802154 rx handle packet() clones the received skb before distribution via ieee802154 subif frame(). Because cloned skbs share the same underlying data buffer, modifications made by llsec do decrypt() corrupt data referenced by other clones. Similarly, on the TX path, data sharing occurs if the skb head has been cloned, as indicated by skb cloned().

This lack of data isolation can lead to silent data corruption of other skb clones, use-after-free conditions when the crypto API writes to a page already freed by kfree skb(), and kernel crashes during concurrent 802.15.4 traffic with security enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.