CVE-2026-63992

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

State: Published
Severity: 9.1 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set.

This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535.

Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part.

Note that iptunnel_pmtud_check_icmpv6()) is fine.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 5a92cb45e34749865d03daf8d3500f77b5f6644cAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before c7b7ec3e69e673c0d6b57f74d21da50c485c598eAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 7f4f7efe7f30edd29c4988de01728bf2398217e4Affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before e917d0c69f01af2bb4fbea2b66d560a53b3ac7ecAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before a096b6e34f602950af9a2b0856cd93a5f4c276d7Affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 43368636c663cff6e59dde93cf4b8e43ac28eb93Affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before cb549df9ce4ee15c9d5b19ddab12cf2128e4313cAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 509323077ef79a26ba0c60bb556e45c12c398b2dAffected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 5a92cb45e34749865d03daf8d3500f77b5f6644cAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before c7b7ec3e69e673c0d6b57f74d21da50c485c598eAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 7f4f7efe7f30edd29c4988de01728bf2398217e4Affected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before e917d0c69f01af2bb4fbea2b66d560a53b3ac7ecAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before a096b6e34f602950af9a2b0856cd93a5f4c276d7Affected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 43368636c663cff6e59dde93cf4b8e43ac28eb93Affected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before cb549df9ce4ee15c9d5b19ddab12cf2128e4313cAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 509323077ef79a26ba0c60bb556e45c12c398b2dAffected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.