CVE-2026-63993 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
skb_tunnel_check_pmtu() can change skb->head.
Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.
Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c.
Found by Sashiko.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's VXLAN implementation where a use-after-free condition can occur due to improper handling of cached IP header pointers. The issue manifests when the skb_tunnel_check_pmtu() function is called, which can modify the skb->head pointer, causing previously cached ip_hdr() values to become invalid and potentially leading to memory corruption. This represents a critical security flaw that could be exploited to execute arbitrary code or cause system instability.
The technical root cause stems from the improper reuse of cached IP header pointers in the VXLAN network driver code. When skb_tunnel_check_pmtu() executes, it may reallocate or modify the socket buffer's head pointer, but the code continues to reference an outdated ip_hdr() cache value. This violates fundamental memory safety principles and creates a scenario where freed memory locations are accessed, potentially allowing attackers to manipulate kernel memory structures through carefully crafted network packets.
The operational impact of this vulnerability extends beyond simple system crashes to potential privilege escalation and denial of service conditions. Attackers could leverage this use-after-free condition to execute arbitrary code with kernel privileges, effectively bypassing security boundaries and gaining full control over affected systems. The vulnerability affects Linux kernel versions where VXLAN networking is enabled, making it particularly concerning for cloud environments and network infrastructure devices that rely heavily on virtualized networking technologies.
Mitigation strategies should focus on immediate kernel updates to patched versions that implement the recommended fix of using ip_hdr(skb) directly instead of cached values as employed in other network driver implementations like bareudp.c and geneve.c. System administrators should also consider implementing network segmentation controls and monitoring for unusual VXLAN traffic patterns that might indicate exploitation attempts. The fix aligns with security best practices outlined in CWE-416, which addresses use-after-free vulnerabilities, and follows ATT&CK techniques related to privilege escalation through kernel exploits. Organizations should prioritize patching this vulnerability as it represents a direct threat to system integrity and could enable attackers to establish persistent backdoors within network infrastructure.
The vulnerability demonstrates the complexity of kernel memory management where seemingly benign function calls can trigger cascading effects that compromise entire security models. This type of issue underscores the importance of rigorous code review processes and automated testing for memory safety in kernel subsystems, particularly those handling network packet processing where timing-sensitive operations can create exploitable race conditions between different kernel components operating on shared data structures.