In the Linux kernel, the following vulnerability has been resolved:

6lowpan: fix off-by-one in multicast context address compression

The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses
&data[1] as destination and &ipaddr->s6_addr[11] as source, but
both should be offset by one: &data[2] and &ipaddr->s6_addr[12]
respectively.

This off-by-one has two consequences:
1. data[1] is overwritten with s6_addr[11], corrupting the RIID
   field in the compressed multicast address
2. data[5] is never written, so uninitialized kernel stack memory
   is transmitted over the network via lowpan_push_hc_data(),
   leaking kernel stack contents

The correct inline data layout must match what the decompression
function lowpan_uncompress_multicast_ctx_daddr() expects:
  data[0..1] = s6_addr[1..2]  (flags/scope + RIID)
  data[2..5] = s6_addr[12..15] (group ID)

Also zero-initialize the data array as a defensive measure against
similar bugs in the future.

https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b

https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837

https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb

https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb

https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419

https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c

https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af

https://git.kernel.org/stable/c/f24a58c72a45f4c109f3557a760cc4b60b7a6037

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/6lowpan/iphc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"f24a58c72a45f4c109f3557a760cc4b60b7a6037","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"da8cbb64b47e9066b40af0de170901caf17b768c","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"4485d79617520d84ba5a14515e2b5136007d6deb","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"06ce6fc106b16dec9b535950db626261be865e5b","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"c32f30ef5e66adbfa102348e2e8a23776eb007cb","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"da8808463882c3f3c357b072e25053c2121f1419","versionType":"git","status":"affected"},{"version":"5609c185f24dffca5f6a9c127106869da150be03","lessThan":"2a58899d11009bffc7b4b32a571858f381121837","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/6lowpan/iphc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.94","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.36","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.13","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]