CVE-2026-63870

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists where the kernel fails to properly validate packets on 6LoWPAN interfaces. When a non-IPv6 packet is queued for transmission via dev queue xmit(), the header ops->create function (specifically lowpan header create or header create) returns early without initializing the lowpan addr info structure in the skb headroom. Subsequently, the lowpan xmit() transmit function calls lowpan header() (or setup header()), which unconditionally copies and uses this uninitialized data from the headroom. A similar issue affects the bt xmit() function in net/bluetooth/6lowpan.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.