CVE-2026-63992
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability was found in the Linux kernel's iptunnel_pmtud_check_icmp() function, which can be called when the transport header in the socket buffer (skb) is not set. This causes an out-of-bounds memory access because the default value (65535) is used as an offset. The fix accesses the ICMP header based on the IPv4 network header.
Risk Assessment
An attacker could exploit this vulnerability to cause a kernel panic or potentially escalate privileges, leading to system denial of service or kernel compromise.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit in the stable branch). Check for the patch availability for your distribution (e.g., Ubuntu, RHEL, Debian) and apply it.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.