CVE-2026-63993

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

State: Published
Severity: 9.8 Critical
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c.

Found by Sashiko.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 6b8bfce9d2f774d2c2243e0248e03efb99bba6c0Affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 9257f56ac47ef1976bcd056cf986a9988eeec67aAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 8d435d68d71fb875876b722f4136caf74f2f48bdAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before dc3bfa050f873371e745bdf478b1f5b738e5733dAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 609e63312c29aad18026a1d3222e123d4b6b0febAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 5303925e360527243b46a440a04667826bbc72b7Affected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before a493efd4336cf19122ae0e4cbb3d31b32d70deeaAffected 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 7d9ef0cb271555d8cf39fefe6c981e1493b25ecfAffected
LinuxLinux	5.9Affected before 5.9Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 6b8bfce9d2f774d2c2243e0248e03efb99bba6c0Affected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 9257f56ac47ef1976bcd056cf986a9988eeec67aAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 8d435d68d71fb875876b722f4136caf74f2f48bdAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before dc3bfa050f873371e745bdf478b1f5b738e5733dAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 609e63312c29aad18026a1d3222e123d4b6b0febAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 5303925e360527243b46a440a04667826bbc72b7Affected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before a493efd4336cf19122ae0e4cbb3d31b32d70deeaAffected
4cb47a8644cc9eb8ec81190a50e79e6530d0297f to before 7d9ef0cb271555d8cf39fefe6c981e1493b25ecfAffected

LinuxLinux

5.9Affected
before 5.9Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.