CVE-2026-53263: Linux 6LoWPAN IPv6 Multicast Compression Off-by-One Flaw

Technical summary

The vulnerability resides in the lowpan_iphc_mcast_ctx_addr_compress() function, which compresses IPv6 multicast addresses for 6LoWPAN transmission. A second memcpy operation uses incorrect buffer offsets—writing to &data[1] instead of &data[2] and reading from &ipaddr->s6_addr[11] instead of &ipaddr->s6_addr[12]. This off-by-one error has dual impact: the RIID (Routing Interface Identifier) field at data[1] is overwritten with stale source data, and data[5] remains uninitialized, permitting kernel stack contents to be leaked when the buffer is transmitted via lowpan_push_hc_data(). The decompression function lowpan_uncompress_multicast_ctx_daddr() expects a specific byte layout that this bug violates, breaking round-trip compression-decompression integrity.

Business impact

Organizations deploying 6LoWPAN-based IoT infrastructure—such as industrial sensor networks, smart building systems, or embedded medical devices—face two operational risks: protocol interoperability failures when compressed multicast packets cannot be properly decompressed at the receiver, and uncontrolled leakage of kernel memory (containing encryption keys, addresses, or sensitive data structures) over wireless interfaces. In regulated environments (healthcare, critical infrastructure), data leakage may trigger compliance violations. The impact is confined to systems actively using 6LoWPAN compression.

Affected systems

The Linux kernel is affected. Systems utilizing 6LoWPAN compression for IPv6 multicast are at risk—particularly ARM-based and embedded platforms running kernels with this code path enabled (common in IoT gateways, IEEE 802.15.4 radio modules, and Bluetooth Low Energy mesh networks). Desktop and server deployments without 6LoWPAN hardware or kernel modules compiled in are unaffected.

Exploitability

Exploitation requires local process privileges and the ability to trigger 6LoWPAN multicast address compression, typically by crafting IPv6 multicast traffic on a system with 6LoWPAN networking active. This is not a remote vulnerability—an attacker cannot exploit it from across a network. However, once triggered, kernel memory leakage occurs passively during normal packet transmission, making it a covert information disclosure mechanism for a local adversary. No CVSS availability impact is scored because the bug does not crash or deny service; the score reflects the confidentiality risk from memory leakage.

Remediation

Apply kernel updates that correct the memcpy offsets to &data[2] and &ipaddr->s6_addr[12], and implement zero-initialization of the data array to prevent future similar bugs. Verify that patches land in the 6lowpan subsystem code path. Organizations unable to patch immediately should audit whether 6LoWPAN is actively deployed and consider disabling the module if not essential to operations.

Patch guidance

Check your Linux kernel version and kernel release notes for 6LoWPAN subsystem fixes dated after the published date (2026-06-25). Patches should explicitly mention correction of lowpan_iphc_mcast_ctx_addr_compress() offsets. Consult vendor advisories (distribution-specific updates, embedded platform vendors) to confirm patch applicability to your kernel configuration. Test patched kernels in a non-production environment to verify multicast functionality is restored.

Detection guidance

Monitor kernel logs for 6LoWPAN errors or decompression failures that occur during IPv6 multicast traffic. If 6LoWPAN is deployed, audit kernel configuration to confirm the vulnerability is present: check if CONFIG_6LOWPAN and CONFIG_6LOWPAN_IPHC are enabled. Network telemetry that detects unexpected kernel addresses or memory patterns in 6LoWPAN packet payloads may indicate leakage. Endpoint Detection and Response (EDR) tools can flag anomalous memory access patterns near the vulnerable function.

Why prioritize this

Although CVSS rates this as MEDIUM (5.5) and it is not on the KEV catalog, the vulnerability combines data corruption (breaking IoT protocol reliability) with kernel memory leakage (confidentiality breach). For organizations operating 6LoWPAN networks, patch urgency is HIGH because of the silent leakage channel and the difficulty of detecting compromised packets in wireless mesh topologies. For non-6LoWPAN deployments, this is LOW priority. Triage by infrastructure inventory: do we use 6LoWPAN?

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects Attack Vector: Local, requiring user-level privileges, and focuses on Availability impact due to protocol corruption. However, the Confidentiality aspect—kernel memory leakage—is underrepresented in the score calculation because CVSS assumes the attacker needs active exploitation. In practice, the leakage is passive and continuous once a 6LoWPAN multicast flow is established, making the real-world information disclosure risk higher for affected IoT deployments.

Frequently asked questions