CVE-2026-63994
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In the Linux kernel, a vulnerability was found in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() functions, where network header pointers (ip_hdr, ipv6_hdr) were cached before a skb_cow() call that can reallocate skb->head. This can lead to a use-after-free (UAF) condition.
Risk Assessment
An attacker could exploit this vulnerability to access kernel memory, potentially leading to privilege escalation or information disclosure.
Recommendation
It is recommended to immediately update the Linux kernel to a version containing the fix that initializes local variables after the skb_cow() call.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.