CVE-2026-63870 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().

Is your site exposed to CVE-2026-63870?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0012

Probability of exploitation

0.02%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/1a827b95e62b4cbe851ae7cc9c961cdfa769cca4 https://git.kernel.org/stable/c/285b0842f2e01c3edf805f1fd64da11d9b7f6b4c https://git.kernel.org/stable/c/3150e6d3223dfc356308125cabf9c34169842d2a https://git.kernel.org/stable/c/3a5f3f7aff18bcc36a57839cf50cf0cc8de707f3 https://git.kernel.org/stable/c/87172cc8dc49aaf54407a31edffb0232f8cb93ab https://git.kernel.org/stable/c/8da95cb6ad7d656c871e776a9c7b77e894d6d89c https://git.kernel.org/stable/c/af07fffbd53ddc3ec3c2a4ca914f27899fa89bca https://git.kernel.org/stable/c/c1819c8defa235c7beda859bc185b1c429a55ecd

Frequently Asked Questions

What is CVE-2026-63870? +

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETH_P_AOE) and queues it for transmission via dev_queue_xmit() on a 6LoWPAN interface (configured by the user or test case). Since the packet is not IPv6, the 6LoWPAN header_ops->create function (lowpan_header_create or header_create) returns early without initializing the lowpan_addr_info structure in the skb headroom. In the transmit function (lowpan_xmit), the driver calls lowpan_header (or setup_header) which unconditionally copies and uses the lowpan_addr_info from the headroom, which contains uninitialized data. Fix this by dropping non IPv6 packets. A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit(). It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-63870? +

CVE-2026-63870 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0012, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-63870? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-63870