CVE-2026-63993 - Vulnerability Details

- vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c
and drivers/net/geneve.c.

Found by Sashiko.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, vxlan processing code caches an IP header pointer, which can be invalidated when the packet buffer is altered by skb_tunnel_check_pmtu(). Reusing the stale pointer results in a use‑after‑free (CWE‑416, CWE‑825). The memory corruption can crash the system or, if attacker controls the freed region, enable arbitrary code execution.

Affected Systems

All Linux kernel builds that include VXLAN support are affected. The CPE list mentions kernels 7.1rc1 through 7.1rc5 as examples, indicating that any kernel with VXLAN enabled, including current mainstream releases, is at risk.

Risk and Exploitability

The CVSS score of 9.8 highlights severe impact, while the EPSS score of less than 1% suggests the exploitation probability is currently low. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need to send a crafted VXLAN packet to a host that has an active VXLAN interface; thus the attack surface is limited to systems with VXLAN enabled.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< 6b8bfce9d2f774d2c2243e0248e03efb99bba6c0
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< 9257f56ac47ef1976bcd056cf986a9988eeec67a
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< 8d435d68d71fb875876b722f4136caf74f2f48bd
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< dc3bfa050f873371e745bdf478b1f5b738e5733d
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< 609e63312c29aad18026a1d3222e123d4b6b0feb
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< 5303925e360527243b46a440a04667826bbc72b7
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< a493efd4336cf19122ae0e4cbb3d31b32d70deea
`4cb47a8644cc9eb8ec81190a50e79e6530d0297f`	affected	< 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,6b8bfce9d2f774d2c2243e0248e03efb99bba6c0)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,9257f56ac47ef1976bcd056cf986a9988eeec67a)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,8d435d68d71fb875876b722f4136caf74f2f48bd)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,dc3bfa050f873371e745bdf478b1f5b738e5733d)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,609e63312c29aad18026a1d3222e123d4b6b0feb)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,5303925e360527243b46a440a04667826bbc72b7)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,a493efd4336cf19122ae0e4cbb3d31b32d70deea)`	affected	code_commit	—
`[4cb47a8644cc9eb8ec81190a50e79e6530d0297f,7d9ef0cb271555d8cf39fefe6c981e1493b25ecf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.9`	affected	generic	—
`[0,5.9)`	unaffected	generic	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version containing the commit that replaces the cached ip_hdr() reference with a fresh ip_hdr(skb) call.
If a kernel upgrade cannot be performed, disable VXLAN interfaces or block VXLAN traffic with firewall rules to restrict acceptance to trusted sources.
Ensure any third‑party or supplemental VXLAN modules are replaced with versions that include the fix.

Generated by OpenCVE AI on October 2, 2026 at 22:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8817-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-2	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8842-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8818-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8849-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8817-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8818-5	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8871-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00514.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7
https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb
https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0
https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf
https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd
https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a
https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea
https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d
https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63993-165e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63993
https://www.cve.org/CVERecord?id=CVE-2026-63993

History

Fri, 02 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

Wed, 22 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63993-165e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63993 https://www.cve.org/CVERecord?id=CVE-2026-63993
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.
Title		vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7 https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0 https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:13.218Z

Updated: 2026-08-05T12:37:57.287Z

Reserved: 2026-07-19T07:54:57.025Z

Link: CVE-2026-63993

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-19T16:17:38.823

Modified: 2026-10-02T19:57:14.137

Link: CVE-2026-63993

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63993 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-02T22:45:18Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object