CVE-2026-63992
Received Received - Intake

Out-of-Bounds Access in Linux Kernel ICMP Tunnel PMTUD

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63992
EUVD
EUVD-2026-45565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where iptunnel_pmtud_check_icmp() can be called without a transport header set. This causes an out-of-bounds access because the code incorrectly assumes the transport header exists, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability involves an out-of-bound access in the Linux kernel's iptunnel_pmtud_check_icmp() function due to incorrect transport header assumptions. Detection requires kernel-level inspection for crashes or memory corruption during ICMP processing in tunnel operations. Check kernel logs for oops or panic messages related to tunnel or ICMP handling.

Impact Analysis

This vulnerability could allow attackers to cause system crashes, execute arbitrary code, or trigger denial-of-service conditions on affected Linux systems by exploiting the out-of-bounds memory access in the tunnel code.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel network stack issue. Standards like GDPR and HIPAA focus on data protection, privacy, and security controls, while this CVE involves a potential out-of-bounds access in the kernel's tunnel handling code.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63992. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart