Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-63993

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.

View on NVD

Analysis

A critical Use-After-Free vulnerability was found in the Linux kernel's VXLAN driver. This could allow an attacker to cause system crashes or potentially execute arbitrary code. Systems using VXLAN for network virtualization or container overlays should apply kernel updates immediately.

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH

EPSS

Probability of exploitation (next 30 days): 0.0018 (0.2%)
Percentile: 7.4%
EPSS: 2026-07-20

Technical description

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.

Published: 7/19/2026, 4:17:38 PM
Last modified: 7/20/2026, 3:17:00 PM

References

HomeEventsBlogResourcesTeam