Look up another CVE · open CVE-2026-63994 in the interactive tracker
CVE-2026-63994
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/ipv4. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63994 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv4/ip_tunnel_core.c
- What this is
- NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv4/ip* · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_INET /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_INET
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.51%, higher than 42.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv4
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.9 | 5.10.259 | 95b6d772bfe7 |
| 5.9 | 5.15.210 | 7254aef4d1a7 |
| 5.9 | 6.1.176 | bf8b3f34c37c |
| 5.9 | 6.6.143 | 76cd9398a047 |
| 5.9 | 6.12.93 | 50750d86a2e5 |
| 5.9 | 6.18.35 | 6dff77899b9e |
| 5.9 | 7.0.12 | f3f204541f28 |
| 5.9 | 7.1 | b4bc94353050 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.
- AC:LAttack complexity, low
- An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.
- PR:NPrivileges required, none
- Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.
- UI:NUser interaction, none
- Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.
- S:UScope, unchanged
- Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.
- C:HConfidentiality impact, high
- Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.
- I:HIntegrity impact, high
- Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.
- A:HAvailability impact, high
- Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path.