Critical 9.8Published Jul 19, 2026

CVE-2026-63994tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

Updated under an hour ago (2026-10-19 11:20 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before 95b6d772bfe788331d9742d73eaa12e113b2adc4; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before 7254aef4d1a7e18e887af9010e2f2dc34806789b; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before bf8b3f34c37c162357138e7c0942723b8b94fed1; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before 76cd9398a0470257ab765bdf5f358a2af2e17934; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before 50750d86a2e5266aba0c295483b3397843198b11; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before 6dff77899b9e9fe5d854abda3a98ad04e7229ef7; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before f3f204541f280a6ecb04503a0d6794d93990ca43; from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f before b4bc94353050b1fa7b702bd4c6600710dd926cff	CNA record
linux linux_kernel linux:linux_kernel	from 5.9 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.35; from 6.19 before 7.0.12; 7.1; and 4 more ranges	NVD

References

https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4patch
https://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789bpatch
https://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1patch
https://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934patch
https://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11patch
https://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7patch
https://git.kernel.org/stable/c/f3f204541f280a6ecb04503a0d6794d93990ca43patch
https://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cffpatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.