Out-of-bounds read in Linux kernel - CVE-2026-63920

Vulnerability identifier: #VU138725

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63920

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ip6_datagram_recv_specific_ctl() when processing IPv6 extension headers for recvmsg control messages after the hdrlen field is modified. A local user can use an nftables payload-write expression to corrupt the extension header length and trigger copying beyond the available header data to disclose sensitive information.

Exploitation is reachable from an unprivileged user namespace.

Linux kernel
openEuler
Ubuntu
kernel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel-extra-modules
linux-ibm (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-tools-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-source - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-debugsource - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
bpftool - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
perf - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
python3-perf - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
python3-perf-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885
• https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90
• https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d
• https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282
• https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af
• https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8
• https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224
• https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992

• Out-of-bounds read in Linux kernel ipv6
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• openEuler 22.03 LTS SP4 update for kernel
• openEuler 24.03 LTS SP3 update for kernel