CVE-2026-63922 (CVSS 9.8)

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.

Is your site exposed to CVE-2026-63922?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0069

Probability of exploitation

0.49%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538 https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63 https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99

Frequently Asked Questions

What is CVE-2026-63922? +

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2026-63922? +

CVE-2026-63922 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0069, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-63922? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-63922