{"id":"CVE-2026-63831","revision":"5b9f7aa040a04ea68f680b05fd48db0a","records":[{"revision":"5b9f7aa040a04ea68f680b05fd48db0a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63831","aliases":[],"title":"mac802154: llsec: add skb_cow_data() before in-place crypto","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: llsec: add skb_cow_data() before in-place crypto\n\nllsec_do_encrypt_unauth(), llsec_do_encrypt_auth(),\nllsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform\nin-place cryptographic transformations on skb data.  They build a\nscatterlist with sg_init_one() pointing into the skb's linear data area\nand then pass the same scatterlist as both src and dst to the crypto API\n(e.g. crypto_skcipher_encrypt/decrypt, crypto_aead_encrypt/decrypt).\n\nOn the RX path, __ieee802154_rx_handle_packet() clones the received skb\nbefore handing it to each subscriber via ieee802154_subif_frame().  The\ncloned skb shares the same underlying data buffer via reference\ncounting.  When llsec_do_decrypt() subsequently modifies this shared\nbuffer in place, it corrupts data that other clones -- potentially\nbelonging to other sockets or subsystems -- still reference.\n\nOn the TX path, similar data sharing can occur when an skb's head has\nbeen cloned (skb_cloned() returns true).\n\nThe fix is to call skb_cow_data() before performing any in-place crypto\noperation.  skb_cow_data() ensures that the skb's data area is not\nshared: if the skb head is cloned or the data spans multiple fragments,\nit copies the data into a private buffer that can be safely modified in\nplace.  This is the same pattern used by:\n\n  - ESP (net/ipv4/esp4.c, net/ipv6/esp6.c)\n  - MACsec (drivers/net/macsec.c)\n  - WireGuard (drivers/net/wireguard/receive.c)\n  - TIPC (net/tipc/crypto.c)\n\nWithout this guard, in-place crypto on shared skb data leads to:\n  - Silent data corruption of other skb clones\n  - Use-after-free when the crypto API scatterwalk writes through a\n    page that has already been freed by another clone's kfree_skb()\n  - Kernel crashes under concurrent 802.15.4 traffic with security\n    enabled (KASAN/KMSAN reports slab-use-after-free)\n\nFound by 0sec (https://0sec.ai) using automated source analysis.","state":0,"publishedAt":"2026-07-19T12:02:24.32+00:00","modifiedAt":"2026-10-19T20:07:49.327+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mac802154/llsec.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"3a2b378b3a9ca75d3518d879148d2ad25b5714a9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"7a831bcd0486788283ef35e396d4282ee01bb0d5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"ff976ef7c39199ebff33c18034636595016db9f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"e28e7fd34c449028325322a3f5127b92594b7396\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"993fd674fe85d114e6a8d3963033d4fbbc2170a8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"bd968bdd568beacfdf98ec537a87527e85f1d0cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"86d531337ea1ba02d9f2bc830d07c683d9bfaade\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03556e4d0dbbbf4af9df76f4a3839c86f6afb015\",\n                            \"lessThan\": \"84a04eb5b210643bd67aab81ff805d32f62aa865\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mac802154/llsec.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.260\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.211\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.177\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.144\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.95\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.38\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.3\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/3a2b378b3a9ca75d3518d879148d2ad25b5714a9","https://git.kernel.org/stable/c/7a831bcd0486788283ef35e396d4282ee01bb0d5","https://git.kernel.org/stable/c/ff976ef7c39199ebff33c18034636595016db9f0","https://git.kernel.org/stable/c/e28e7fd34c449028325322a3f5127b92594b7396","https://git.kernel.org/stable/c/993fd674fe85d114e6a8d3963033d4fbbc2170a8","https://git.kernel.org/stable/c/bd968bdd568beacfdf98ec537a87527e85f1d0cf","https://git.kernel.org/stable/c/86d531337ea1ba02d9f2bc830d07c683d9bfaade","https://git.kernel.org/stable/c/84a04eb5b210643bd67aab81ff805d32f62aa865"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63831","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63831","identifiers":["CVE-2026-63831"]},"retained":false,"historicalAffected":[]}],"coverage":[]}