CVE-2026-63831 (GCVE-0-2026-63831)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mac802154: llsec: add skb_cow_data() before in-place crypto
llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),
llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform
in-place cryptographic transformations on skb data. They build a
scatterlist with sg_init_one() pointing into the skb's linear data area
and then pass the same scatterlist as both src and dst to the crypto API
(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).
On the RX path, __ieee802154_rx_handle_packet() clones the received skb
before handing it to each subscriber via ieee802154_subif_frame(). The
cloned skb shares the same underlying data buffer via reference
counting. When llsec_do_decrypt() subsequently modifies this shared
buffer in place, it corrupts data that other clones -- potentially
belonging to other sockets or subsystems -- still reference.
On the TX path, similar data sharing can occur when an skb's head has
been cloned (skb_cloned() returns true).
The fix is to call skb_cow_data() before performing any in-place crypto
operation. skb_cow_data() ensures that the skb's data area is not
shared: if the skb head is cloned or the data spans multiple fragments,
it copies the data into a private buffer that can be safely modified in
place. This is the same pattern used by:
- ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)
- MACsec (drivers/net/macsec.c)
- WireGuard (drivers/net/wireguard/receive.c)
- TIPC (net/tipc/crypto.c)
Without this guard, in-place crypto on shared skb data leads to:
- Silent data corruption of other skb clones
- Use-after-free when the crypto API scatterwalk writes through a
page that has already been freed by another clone's kfree_skb()
- Kernel crashes under concurrent 802.15.4 traffic with security
enabled (KASAN/KMSAN reports slab-use-after-free)
Found by 0sec (https://0sec.ai) using automated source analysis.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 Version: 03556e4d0dbbbf4af9df76f4a3839c86f6afb015 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac802154/llsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3a2b378b3a9ca75d3518d879148d2ad25b5714a9",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "7a831bcd0486788283ef35e396d4282ee01bb0d5",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "ff976ef7c39199ebff33c18034636595016db9f0",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "e28e7fd34c449028325322a3f5127b92594b7396",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "993fd674fe85d114e6a8d3963033d4fbbc2170a8",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "bd968bdd568beacfdf98ec537a87527e85f1d0cf",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "86d531337ea1ba02d9f2bc830d07c683d9bfaade",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
},
{
"lessThan": "84a04eb5b210643bd67aab81ff805d32f62aa865",
"status": "affected",
"version": "03556e4d0dbbbf4af9df76f4a3839c86f6afb015",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac802154/llsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data. They build a\nscatterlist with sg_init_one() pointing into the skb\u0027s linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame(). The\ncloned skb shares the same underlying data buffer via reference\ncounting. When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb\u0027s head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation. skb_cow_data() ensures that the skb\u0027s data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace. This is the same pattern used by:\n\n - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n - MACsec (drivers/net/macsec.c)\n - WireGuard (drivers/net/wireguard/receive.c)\n - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n - Silent data corruption of other skb clones\n - Use-after-free when the crypto API scatterwalk writes through a\n page that has already been freed by another clone\u0027s kfree_skb()\n - Kernel crashes under concurrent 802.15.4 traffic with security\n enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when the kernel processes incoming IEEE 802.15.4 frames from a radio driver (ieee802154_rx \u2192 llsec_do_decrypt), which requires an attacker within WPAN radio range, analogous to Bluetooth/WiFi adjacent-segment attacks.\nAC:L - An attacker can reliably trigger the flaw by transmitting valid LLSEC-protected 802.15.4 frames (including broadcast frames fanning out to multiple virtual interfaces) and controlling traffic timing; the skb_clone sharing is deterministic on the RX path.\nPR:N - Exploitation requires no local privileges on the victim\u2014only the ability to send 802.15.4 radio frames as a PAN participant with valid LLSEC credentials, which is a network-position requirement rather than elevated kernel access.\nUI:N - No end-user action is needed at exploitation time; triggering the bug only requires the target to already be running mac802154 with LLSEC enabled and receiving attacker-crafted wireless frames.\nS:U - Impact is confined to kernel memory/subsystems on the affected host (UAF, data corruption, crash); it does not inherently cross a VM, container, or IOMMU security boundary.\nC:H - The commit and fix description confirm slab use-after-free from in-place crypto scatterwalk writes through skb data pages freed by sibling clones, enabling arbitrary kernel memory reads.\nI:H - Writing through freed/shared skb pages during in-place decrypt/encrypt corrupts kernel heap contents and provides a standard exploitable memory-corruption primitive for arbitrary modification or code execution.\nA:H - Concurrent LLSEC-enabled 802.15.4 traffic can cause kernel oops/panic, and KASAN/KMSAN reports confirm slab-use-after-free crashes under the vulnerable code path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:40.171Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9"
},
{
"url": "https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5"
},
{
"url": "https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0"
},
{
"url": "https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396"
},
{
"url": "https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8"
},
{
"url": "https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf"
},
{
"url": "https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade"
},
{
"url": "https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865"
}
],
"title": "mac802154: llsec: add skb_cow_data() before in-place crypto",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63831",
"datePublished": "2026-07-19T12:02:24.320Z",
"dateReserved": "2026-07-19T07:54:57.015Z",
"dateUpdated": "2026-08-17T04:51:40.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…