CVE-2026-63994
Received Received - Intake

Buffer Overflow Fix in Linux Kernel Networking Stack

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63994
EUVD
EUVD-2026-45567

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's tunnel handling code. The functions iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() cache network header pointers before calling skb_cow(), which may reallocate the socket buffer's head. This can lead to accessing freed memory when the cached pointers are used later.

Detection Guidance

This vulnerability is specific to the Linux kernel's tunnel handling code and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using tools like 'dmesg' to identify crashes or UAF (Use-After-Free) issues in tunnel-related operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could cause system crashes, kernel panics, or privilege escalation if exploited. It may allow an attacker to execute arbitrary code in the kernel context or cause denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's tunnel handling code. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel-level memory safety issues.

Mitigation Strategies

Apply the kernel patch that fixes the issue in iptunnel_pmtud_build_icmp[v6](). Update to a patched Linux kernel version. Monitor kernel logs for tunnel-related errors post-update. If immediate patching is not possible, consider disabling tunnel-related features temporarily as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63994. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart