GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63993 (GCVE-0-2026-63993)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:37
VLAI
Title
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
Summary
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 6b8bfce9d2f774d2c2243e0248e03efb99bba6c0 (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 9257f56ac47ef1976bcd056cf986a9988eeec67a (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 8d435d68d71fb875876b722f4136caf74f2f48bd (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < dc3bfa050f873371e745bdf478b1f5b738e5733d (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 609e63312c29aad18026a1d3222e123d4b6b0feb (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 5303925e360527243b46a440a04667826bbc72b7 (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < a493efd4336cf19122ae0e4cbb3d31b32d70deea (git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b8bfce9d2f774d2c2243e0248e03efb99bba6c0",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "9257f56ac47ef1976bcd056cf986a9988eeec67a",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "8d435d68d71fb875876b722f4136caf74f2f48bd",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "dc3bfa050f873371e745bdf478b1f5b738e5733d",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "609e63312c29aad18026a1d3222e123d4b6b0feb",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "5303925e360527243b46a440a04667826bbc72b7",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "a493efd4336cf19122ae0e4cbb3d31b32d70deea",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            },
            {
              "lessThan": "7d9ef0cb271555d8cf39fefe6c981e1493b25ecf",
              "status": "affected",
              "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n\nskb_tunnel_check_pmtu() can change skb-\u003ehead.\n\nReusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.\n\nUse instead ip_hdr(skb) as done in drivers/net/bareudp.c\nand drivers/net/geneve.c.\n\nFound by Sashiko."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in VXLAN transmit processing reached when network-originated packets are decapsulated, bridged, and re-encapsulated; VXLAN is a UDP-based overlay protocol reachable from remote peers over the network.\nAC:L - An attacker can reliably trigger the bug by sending crafted oversized inner IPv4/IPv6 packets (e.g., with DF set or ICMP/ICMPv6 payloads) through a bridged VXLAN interface to force skb_tunnel_check_pmtu() to reallocate skb-\u003ehead yet return 0, leaving the cached ip_hdr pointer stale.\nPR:N - Exploitation requires only the ability to send VXLAN/inner IP traffic to a host with an active VXLAN bridge port; no local account, capabilities, or authentication on the victim is needed.\nUI:N - No victim user action is required beyond normal network operation; triggering the bug is entirely driven by attacker-supplied packets forwarded through the VXLAN device.\nS:U - The vulnerability corrupts kernel heap memory on the host processing the VXLAN traffic; impact remains within the kernel\u0027s security authority and does not inherently cross a VM or sandbox boundary.\nC:H - This is a use-after-free where ip_tunnel_ecn_encap() reads from a freed skb head via the stale cached ip_hdr pointer, enabling kernel memory disclosure and supporting further exploitation.\nI:H - Use-after-free on skb data provides a foundation for heap grooming and arbitrary memory write primitives that could be leveraged for kernel code execution or privilege escalation.\nA:H - The UAF can cause kernel oops/panic during transmit processing and is independently exploitable for denial of service even when full code execution is not achieved."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:57.287Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d"
        },
        {
          "url": "https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf"
        }
      ],
      "title": "vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63993",
    "datePublished": "2026-07-19T14:56:13.218Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-08-05T12:37:57.287Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63993",
      "date": "2026-09-20",
      "epss": "0.00514",
      "percentile": "0.42775"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/vxlan/vxlan_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6b8bfce9d2f774d2c2243e0248e03efb99bba6c0",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9257f56ac47ef1976bcd056cf986a9988eeec67a",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8d435d68d71fb875876b722f4136caf74f2f48bd",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc3bfa050f873371e745bdf478b1f5b738e5733d",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "609e63312c29aad18026a1d3222e123d4b6b0feb",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5303925e360527243b46a440a04667826bbc72b7",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a493efd4336cf19122ae0e4cbb3d31b32d70deea",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d9ef0cb271555d8cf39fefe6c981e1493b25ecf",
                    "status": "affected",
                    "version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/vxlan/vxlan_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.9"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()\n\nskb_tunnel_check_pmtu() can change skb-\u003ehead.\n\nReusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.\n\nUse instead ip_hdr(skb) as done in drivers/net/bareudp.c\nand drivers/net/geneve.c.\n\nFound by Sashiko."
          }
        ],
        "id": "CVE-2026-63993",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:38.823",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-08T19:41:41+00:00",
      "cve": "CVE-2026-63993",
      "id": "CVE-2026-63993",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63993.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T16:39:29Z",
      "cve": "CVE-2026-63993",
      "id": "CVE-2026-63993",
      "initial_release_date": "2026-07-21T13:01:59Z",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63993",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63993.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.