CVE-2026-63922

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IPv6 extension header handling where the ip6 parse tlv() function caches the network header pointer in nh while processing Type-Length-Value (TLV) structures. When ipv6 dest hao() is called, it may trigger pskb expand head() for a cloned socket buffer (skb), which can relocate the buffer head and invalidate the cached nh pointer. This leads to a situation where subsequent trailing padding or TLVs are parsed from an incorrect memory location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.