SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-63994

CRITICAL · CVSS 9.8 EPSS 0.52%

Source: NVD + CISA KEV + EPSS · Published 2026-07-19 · Last synced 2026-08-18

CyberRota Analysis

AI-Generated

The vulnerability in the Linux kernel affects the iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() functions, where improper handling of network headers can lead to a use-after-free condition due to caching headers before a critical memory reallocation. This flaw poses a significant risk, potentially allowing attackers to execute arbitrary code or cause a denial of service. Organizations using affected Linux kernel versions should prioritize patching this vulnerability to mitigate the associated risks.

CVE
CVE-2026-63994
Severity
CRITICAL
CVSS
9.8
EPSS
0.52%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.