{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()  ipv6_rpl_srh_decompress() computes:      outhdr-\u003ehdrlen = (((n + 1) * sizeof(struct in6_addr)) \u003e\u003e 3);  hdrlen is __u8. For n \u003e= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16):      (128 * 16) \u003e\u003e 3 = 256, truncated to 0 as __u8  The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr-\u003ehdrlen + 1) \u003c\u003c 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet.  The existing guard at exthdrs.c:546 checks (n + 1) \u003e 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 \u003c= 255, yet hdrlen=256 does not fit.  Tighten the bound to (n + 1) \u003e 127. This caps n at 126, giving hdrlen = (127 * 16) \u003e\u003e 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) \u003c\u003c 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment.",
  "id": "DEBIAN-CVE-2026-63984",
  "modified": "2026-09-14T16:47:45.942556653Z",
  "published": "2026-07-19T16:17:17.590Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-63984"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-63984"
  ]
}