CVE-2026-63870: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()
In the Linux kernel, the following vulnerability has been resolved:
ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit()
The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETHPAOE) and queues it for transmission via devqueuexmit() on a 6LoWPAN interface (configured by the user or test case).
Since the packet is not IPv6, the 6LoWPAN headerops->create function (lowpanheadercreate or headercreate) returns early without initializing the lowpanaddrinfo structure in the skb headroom.
In the transmit function (lowpanxmit), the driver calls lowpanheader (or setupheader) which unconditionally copies and uses the lowpanaddrinfo from the headroom, which contains uninitialized data.
Fix this by dropping non IPv6 packets.
A similar fix is needed in net/bluetooth/6lowpan.c btxmit().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify/patch the 6LoWPAN transmit path (lowpan_xmit, including bt_xmit in net/bluetooth/6lowpan.c) to only accept IPv6 packets on 6LoWPAN interfaces; drop non-IPv6 packets so lowpan_header/headroom uninitialized data is not copied/used.
ieee802154: 6lowpan (lowpan_xmit) drop non-IPv6 packets = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63870?
CVE-2026-63870 has a high severity rating of 7.8.
How do I fix CVE-2026-63870?
To fix CVE-2026-63870, update your Linux Kernel to the latest version that includes the patch for this vulnerability.
What type of packets does CVE-2026-63870 affect?
CVE-2026-63870 affects the transmission of non-IPv6 packets over 6LoWPAN interfaces.
Is CVE-2026-63870 a remote vulnerability?
CVE-2026-63870 is classified as a local vulnerability since it can be exploited on a local network.
Which software is affected by CVE-2026-63870?
CVE-2026-63870 affects the Linux Kernel, specifically in the ieee802154 module.