CVE-2026-63994 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head.
Fix this possible UAF by initializing the local variables after the skb_cow() call.
Remove skb_reset_network_header() calls which were not needed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability resides in the Linux kernel's network tunneling implementation, specifically within the packet processing functions iptunnel_pmtud_build_icmp and iptunnel_pmtud_build_icmpv6. The issue manifests as a potential use-after-free condition that occurs when network headers are cached prematurely before memory reallocation operations. The flaw demonstrates a classic memory management vulnerability where local variables containing pointers to network header structures are initialized before an skb_cow() operation that may relocate the underlying packet buffer. This creates a scenario where cached header pointers become invalid after the reallocation, leading to potential exploitation through memory corruption.
The technical root cause involves improper ordering of operations within the tunneling code path where ip_hdr() and ipv6_hdr() functions are called to cache network header pointers before the skb_cow() function executes. The skb_cow() operation serves to ensure that the socket buffer's data area is writable and may trigger memory reallocation when the current buffer is shared or read-only. When this reallocation occurs, the previously cached header pointers become dangling references pointing to deallocated memory regions. This pattern aligns with CWE-416, which describes use-after-free vulnerabilities, and represents a common class of memory safety issues in kernel networking code where pointer invalidation occurs due to improper sequence of memory management operations.
The operational impact of this vulnerability extends beyond simple memory corruption as it affects the fundamental packet processing pipeline within the Linux kernel's tunneling subsystem. Attackers could potentially exploit this condition to execute arbitrary code with kernel privileges, leading to complete system compromise. The vulnerability is particularly concerning because it occurs during PMTU (Path Maximum Transmission Unit) discovery operations, which are critical for network connectivity and packet fragmentation handling. This makes the attack surface more significant as legitimate network operations involving tunneling protocols could trigger the vulnerable code path, potentially allowing remote exploitation through crafted network packets.
The fix implemented addresses this vulnerability by reordering the operations to initialize local header variables after the skb_cow() call has completed, ensuring that subsequent pointer references remain valid. The solution also removes unnecessary skb_reset_network_header() calls that were not required for proper header management, simplifying the code flow and reducing potential points of failure. This remediation follows established kernel security practices and aligns with ATT&CK technique T1068 by addressing a privilege escalation vector through memory corruption. The fix ensures proper synchronization between memory allocation operations and pointer validity, preventing the use-after-free condition that could be exploited to gain unauthorized system access.
This vulnerability demonstrates the critical importance of proper memory management ordering in kernel space code, particularly when dealing with shared data structures and packet buffer manipulation. The remediation approach exemplifies defensive programming practices that should be applied throughout kernel networking subsystems where similar patterns may exist. Security researchers should examine other network processing functions for similar timing issues involving buffer reallocations and header caching operations to prevent analogous vulnerabilities in the broader kernel codebase.