CVE-2026-63992 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set.
This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535.
Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part.
Note that iptunnel_pmtud_check_icmpv6()) is fine.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the Linux kernel's networking stack specifically in the tunneling subsystem where the function iptunnel_pmtud_check_icmp() exhibits unsafe memory access behavior. This function processes ICMP packets for path MTU discovery operations in tunnel contexts, but fails to properly validate the presence and correctness of transport layer headers before attempting memory accesses. The flaw occurs when the function is invoked with a socket buffer (skb) where the transport header has not been properly initialized or set, creating a dangerous assumption that certain network layer pointers are valid.
The technical implementation issue stems from an improper handling of pointer arithmetic and memory access patterns within the kernel's packet processing pipeline. When iptunnel_pmtud_check_icmp() executes without a properly configured transport header, it attempts to access memory locations using the expression (typeof(skb->transport_header))~0U which evaluates to 65535, effectively creating an out-of-bounds memory read operation. This occurs because the function assumes that all necessary network layer headers are already properly positioned within the packet buffer structure, but fails to validate this precondition before proceeding with memory operations.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling attackers to trigger kernel crashes or, in more sophisticated scenarios, achieve privilege escalation through controlled memory access violations. The vulnerability affects systems running Linux kernels that utilize tunneling protocols such as GRE, IP-in-IP, or other encapsulation mechanisms where path MTU discovery operations are performed. Since the issue specifically impacts IPv4 processing while IPv6 versions (iptunnel_pmtud_check_icmpv6) remain unaffected, it represents a targeted weakness in the kernel's network protocol handling that could be exploited to disrupt network services or compromise system stability.
This vulnerability maps directly to CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write within the Common Weakness Enumeration framework, demonstrating how improper validation of network packet headers can lead to memory safety issues in kernel space. The flaw aligns with ATT&CK technique T1068 Exploitation for Privilege Escalation through kernel-level vulnerabilities, as it represents an entry point for potential privilege escalation attacks that could leverage the kernel's memory management subsystem. Mitigation strategies should include immediate kernel updates to patched versions, implementation of proper header validation checks before memory operations, and enhanced input sanitization within network packet processing functions. Additionally, system administrators should monitor for unusual network traffic patterns that might indicate exploitation attempts and implement proper intrusion detection systems to identify potential abuse of this vulnerability in production environments.