CVE-2026-63831

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63831", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.015Z", "datePublished": "2026-07-19T12:02:24.320Z", "dateUpdated": "2026-10-19T20:07:49.327Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:40.171Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone's kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is reached when the kernel processes incoming IEEE 802.15.4 frames from a radio driver (ieee802154_rx \u2192 llsec_do_decrypt), which requires an attacker within WPAN radio range, analogous to Bluetooth/WiFi adjacent-segment attacks.\nAC:L - An attacker can reliably trigger the flaw by transmitting valid LLSEC-protected 802.15.4 frames (including broadcast frames fanning out to multiple virtual interfaces) and controlling traffic timing; the skb_clone sharing is deterministic on the RX path.\nPR:N - Exploitation requires no local privileges on the victim\u2014only the ability to send 802.15.4 radio frames as a PAN participant with valid LLSEC credentials, which is a network-position requirement rather than elevated kernel access.\nUI:N - No end-user action is needed at exploitation time; triggering the bug only requires the target to already be running mac802154 with LLSEC enabled and receiving attacker-crafted wireless frames.\nS:U - Impact is confined to kernel memory/subsystems on the affected host (UAF, data corruption, crash); it does not inherently cross a VM, container, or IOMMU security boundary.\nC:H - The commit and fix description confirm slab use-after-free from in-place crypto scatterwalk writes through skb data pages freed by sibling clones, enabling arbitrary kernel memory reads.\nI:H - Writing through freed/shared skb pages during in-place decrypt/encrypt corrupts kernel heap contents and provides a standard exploitable memory-corruption primitive for arbitrary modification or code execution.\nA:H - Concurrent LLSEC-enabled 802.15.4 traffic can cause kernel oops/panic, and KASAN/KMSAN reports confirm slab-use-after-free crashes under the vulnerable code path."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac802154/llsec.c"], "versions": [{"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "7a831bcd0486788283ef35e396d4282ee01bb0d5", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "ff976ef7c39199ebff33c18034636595016db9f0", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "e28e7fd34c449028325322a3f5127b92594b7396", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "993fd674fe85d114e6a8d3963033d4fbbc2170a8", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "bd968bdd568beacfdf98ec537a87527e85f1d0cf", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "86d531337ea1ba02d9f2bc830d07c683d9bfaade", "status": "affected", "versionType": "git"}, {"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "84a04eb5b210643bd67aab81ff805d32f62aa865", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac802154/llsec.c"], "versions": [{"version": "3.16", "status": "affected"}, {"version": "0", "lessThan": "3.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.260", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.211", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.10.260"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "5.15.211"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9"}, {"url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5"}, {"url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0"}, {"url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396"}, {"url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8"}, {"url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf"}, {"url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade"}, {"url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865"}], "title": "mac802154: llsec: add skb_cow_data() before in-place crypto", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:31:21.214861Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:07:49.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63831", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:31:21.214861Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:31:22.419Z"}}], "cna": {"title": "mac802154: llsec: add skb_cow_data() before in-place crypto", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The bug is reached when the kernel processes incoming IEEE 802.15.4 frames from a radio driver (ieee802154_rx \u2192 llsec_do_decrypt), which requires an attacker within WPAN radio range, analogous to Bluetooth/WiFi adjacent-segment attacks.\nAC:L - An attacker can reliably trigger the flaw by transmitting valid LLSEC-protected 802.15.4 frames (including broadcast frames fanning out to multiple virtual interfaces) and controlling traffic timing; the skb_clone sharing is deterministic on the RX path.\nPR:N - Exploitation requires no local privileges on the victim\u2014only the ability to send 802.15.4 radio frames as a PAN participant with valid LLSEC credentials, which is a network-position requirement rather than elevated kernel access.\nUI:N - No end-user action is needed at exploitation time; triggering the bug only requires the target to already be running mac802154 with LLSEC enabled and receiving attacker-crafted wireless frames.\nS:U - Impact is confined to kernel memory/subsystems on the affected host (UAF, data corruption, crash); it does not inherently cross a VM, container, or IOMMU security boundary.\nC:H - The commit and fix description confirm slab use-after-free from in-place crypto scatterwalk writes through skb data pages freed by sibling clones, enabling arbitrary kernel memory reads.\nI:H - Writing through freed/shared skb pages during in-place decrypt/encrypt corrupts kernel heap contents and provides a standard exploitable memory-corruption primitive for arbitrary modification or code execution.\nA:H - Concurrent LLSEC-enabled 802.15.4 traffic can cause kernel oops/panic, and KASAN/KMSAN reports confirm slab-use-after-free crashes under the vulnerable code path."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "7a831bcd0486788283ef35e396d4282ee01bb0d5", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "ff976ef7c39199ebff33c18034636595016db9f0", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "e28e7fd34c449028325322a3f5127b92594b7396", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "993fd674fe85d114e6a8d3963033d4fbbc2170a8", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "bd968bdd568beacfdf98ec537a87527e85f1d0cf", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "86d531337ea1ba02d9f2bc830d07c683d9bfaade", "versionType": "git"}, {"status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "lessThan": "84a04eb5b210643bd67aab81ff805d32f62aa865", "versionType": "git"}], "programFiles": ["net/mac802154/llsec.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"status": "unaffected", "version": "0", "lessThan": "3.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.260", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.211", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.177", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.38", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.3", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mac802154/llsec.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9"}, {"url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5"}, {"url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0"}, {"url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396"}, {"url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8"}, {"url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf"}, {"url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade"}, {"url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone's kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.260", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.211", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.177", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.144", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.95", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.38", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.3", "versionStartIncluding": "3.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:40.171Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63831", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:07:49.327Z", "dateReserved": "2026-07-19T07:54:57.015Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T12:02:24.320Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac802154/llsec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3a2b378b3a9ca75d3518d879148d2ad25b5714a9", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "7a831bcd0486788283ef35e396d4282ee01bb0d5", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "ff976ef7c39199ebff33c18034636595016db9f0", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "e28e7fd34c449028325322a3f5127b92594b7396", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "993fd674fe85d114e6a8d3963033d4fbbc2170a8", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "bd968bdd568beacfdf98ec537a87527e85f1d0cf", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "86d531337ea1ba02d9f2bc830d07c683d9bfaade", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}, {"lessThan": "84a04eb5b210643bd67aab81ff805d32f62aa865", "status": "affected", "version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac802154/llsec.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.16"}, {"lessThan": "3.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.260", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.211", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.177", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.144", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "67C2057D-145D-49EA-810A-14CA51633998", "versionEndExcluding": "5.10.260", "versionStartIncluding": "3.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D71C101E-388C-4A46-BD99-49049F7C5CFF", "versionEndExcluding": "5.15.211", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "333C9E30-7FD4-46A2-94EF-C1AA1F3EE28B", "versionEndExcluding": "6.1.177", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E", "versionEndExcluding": "6.6.144", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A", "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone's kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis."}], "id": "CVE-2026-63831", "lastModified": "2026-10-22T19:24:19.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63831", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:31:21.214861Z", "version": "2.0.3"}}]}, "published": "2026-07-19T12:16:56.460", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: mac802154: llsec: add skb_cow_data() before in-place crypto", "id": "2502243", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502243"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-820", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmac802154: llsec: add skb_cow_data() before in-place crypto\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n- ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n- MACsec (drivers/net/macsec.c)\n- WireGuard (drivers/net/wireguard/receive.c)\n- TIPC (net/tipc/crypto.c)\nWithout this guard, in-place crypto on shared skb data leads to:\n- Silent data corruption of other skb clones\n- Use-after-free when the crypto API scatterwalk writes through a\npage that has already been freed by another clone's kfree_skb()\n- Kernel crashes under concurrent 802.15.4 traffic with security\nenabled (KASAN/KMSAN reports slab-use-after-free)\nFound by 0sec (https://0sec.ai) using automated source analysis.", "A flaw was found in the Linux kernel's mac802154 (IEEE 802.15.4 MAC security) component. This vulnerability allows for data corruption and potential kernel crashes when cryptographic transformations are performed on shared network packet data without proper isolation. A remote attacker could exploit this by sending specific 802.15.4 traffic, leading to system instability or denial of service."], "name": "CVE-2026-63831", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63831\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63831\nhttps://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-63831-36ca@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,3a2b378b3a9ca75d3518d879148d2ad25b5714a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,7a831bcd0486788283ef35e396d4282ee01bb0d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,ff976ef7c39199ebff33c18034636595016db9f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,e28e7fd34c449028325322a3f5127b92594b7396)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,993fd674fe85d114e6a8d3963033d4fbbc2170a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,bd968bdd568beacfdf98ec537a87527e85f1d0cf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,86d531337ea1ba02d9f2bc830d07c683d9bfaade)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[03556e4d0dbbbf4af9df76f4a3839c86f6afb015,84a04eb5b210643bd67aab81ff805d32f62aa865)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.260,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.211,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.177,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T02:15:04.202160+00:00", "updated": "2026-10-20T09:00:13.984732+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}