CVE-2026-63993

Analyzed Analyzed - Analysis Complete

Linux Kernel VxLAN PMTU UAF Vulnerability

Publication date: 2026-07-19

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-02

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63993

EUVD

EUVD-2026-45566

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 5.9 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's VXLAN implementation. It occurs when skb_tunnel_check_pmtu() modifies skb->head, but the code incorrectly reuses a cached ip_hdr() value afterward. This leads to accessing freed memory, causing potential crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's VXLAN implementation and requires kernel-level detection. Check if your kernel version includes the vulnerable code path by examining the VXLAN module. Use commands like 'uname -a' to check kernel version and 'lsmod | grep vxlan' to verify VXLAN module loading. No direct network commands detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or execute arbitrary code with kernel privileges. This may lead to denial-of-service conditions or unauthorized access to sensitive data on systems using vulnerable Linux kernel versions.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's VXLAN implementation. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel-level memory management flaws.

Mitigation Strategies

Update your Linux kernel to a patched version that resolves this issue. Monitor vendor advisories for kernel updates. If immediate patching isn't possible, disable VXLAN functionality temporarily as a workaround until the kernel is updated.

Hi! I’m here to help you understand CVE-2026-63993. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70