CVE-2026-63992

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Access in Linux Kernel ICMP Tunnel PMTUD

Publication date: 2026-07-19

Last updated on: 2026-10-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-07

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63992

EUVD

EUVD-2026-45565

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 5.9 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where iptunnel_pmtud_check_icmp() can be called without a transport header set. This causes an out-of-bounds access because the code incorrectly assumes the transport header exists, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability involves an out-of-bound access in the Linux kernel's iptunnel_pmtud_check_icmp() function due to incorrect transport header assumptions. Detection requires kernel-level inspection for crashes or memory corruption during ICMP processing in tunnel operations. Check kernel logs for oops or panic messages related to tunnel or ICMP handling.

Impact Analysis

This vulnerability could allow attackers to cause system crashes, execute arbitrary code, or trigger denial-of-service conditions on affected Linux systems by exploiting the out-of-bounds memory access in the tunnel code.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel network stack issue. Standards like GDPR and HIPAA focus on data protection, privacy, and security controls, while this CVE involves a potential out-of-bounds access in the kernel's tunnel handling code.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-63992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70