CVE-2026-63994

Analyzed Analyzed - Analysis Complete

Buffer Overflow Fix in Linux Kernel Networking Stack

Publication date: 2026-07-19

Last updated on: 2026-10-07

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-07

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-63994

EUVD

EUVD-2026-45567

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 5.9 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's tunnel handling code. The functions iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() cache network header pointers before calling skb_cow(), which may reallocate the socket buffer's head. This can lead to accessing freed memory when the cached pointers are used later.

Detection Guidance

This vulnerability is specific to the Linux kernel's tunnel handling code and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using tools like 'dmesg' to identify crashes or UAF (Use-After-Free) issues in tunnel-related operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could cause system crashes, kernel panics, or privilege escalation if exploited. It may allow an attacker to execute arbitrary code in the kernel context or cause denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's tunnel handling code. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel-level memory safety issues.

Mitigation Strategies

Apply the kernel patch that fixes the issue in iptunnel_pmtud_build_icmp[v6](). Update to a patched Linux kernel version. Monitor kernel logs for tunnel-related errors post-update. If immediate patching is not possible, consider disabling tunnel-related features temporarily as a workaround.

Hi! I’m here to help you understand CVE-2026-63994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70