CVE-2026-63993
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In the Linux kernel VXLAN driver, a vulnerability was found where a cached ip_hdr() pointer is reused after calling skb_tunnel_check_pmtu(), which can change skb->head. This leads to a Use-After-Free condition that can be exploited to compromise system security.
Risk Assessment
The vulnerability could allow an attacker to remotely execute code or cause a kernel panic by sending specially crafted VXLAN traffic, threatening system availability and integrity.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit removing reuse of the old ip_hdr() pointer). Monitor your distribution for the patch and apply it as a priority.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.