CVE-2026-63870

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit()

The aoe driver (or similar) generates a non-IPv6 packet (e.g., ETHPAOE) and queues it for transmission via devqueuexmit() on a 6LoWPAN interface (configured by the user or test case).

Since the packet is not IPv6, the 6LoWPAN headerops->create function (lowpanheadercreate or headercreate) returns early without initializing the lowpanaddrinfo structure in the skb headroom.

In the transmit function (lowpanxmit), the driver calls lowpanheader (or setupheader) which unconditionally copies and uses the lowpanaddr_info from the headroom, which contains uninitialized data.

Fix this by dropping non IPv6 packets.

A similar fix is needed in net/bluetooth/6lowpan.c bt_xmit().