CVE-2026-63993 PUBLISHED

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

Assigner: Linux
Reserved: 19.07.2026 Published: 19.07.2026 Updated: 20.07.2026

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c.

Found by Sashiko.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

CVSS 3.1

Vendor	Linux
Product	Linux
Versions	Default: unaffected affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to 6b8bfce9d2f774d2c2243e0248e03efb99bba6c0 (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to 9257f56ac47ef1976bcd056cf986a9988eeec67a (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to 8d435d68d71fb875876b722f4136caf74f2f48bd (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to dc3bfa050f873371e745bdf478b1f5b738e5733d (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to 609e63312c29aad18026a1d3222e123d4b6b0feb (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to 5303925e360527243b46a440a04667826bbc72b7 (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to a493efd4336cf19122ae0e4cbb3d31b32d70deea (excl.) affected from 4cb47a8644cc9eb8ec81190a50e79e6530d0297f to 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf (excl.)

Vendor	Linux
Product	Linux
Versions	Default: affected Version 5.9 is affected unaffected from 0 to 5.9 (excl.) unaffected from 5.10.259 to 5.10.* (incl.) unaffected from 5.15.210 to 5.15.* (incl.) unaffected from 6.1.176 to 6.1.* (incl.) unaffected from 6.6.143 to 6.6.* (incl.) unaffected from 6.12.93 to 6.12.* (incl.) unaffected from 6.18.35 to 6.18.* (incl.) unaffected from 7.0.12 to 7.0.* (incl.) unaffected from 7.1 to * (incl.)