CVE-2026-63992 Details
Description
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.
A vulnerability in the Linux kernel's tunnels module can lead to an out-of-bounds access in the Path Maximum Transmission Unit (PMTU) discovery process for ICMP packets. This issue arises because the transport header of the socket buffer (skb) may not be set, causing the ICMP header to be accessed based on the IPv4 network header without proper validation. The vulnerability affects several versions of the Linux kernel.
Users can upgrade to the latest stable version of the Linux kernel, where this vulnerability has been fixed. Instructions for downloading the latest version can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/43368636c663cff6e59dde93cf4b8e43ac28eb93 | kernel.org | Patch |
| https://git.kernel.org/stable/c/509323077ef79a26ba0c60bb556e45c12c398b2d | kernel.org | Patch |
| https://git.kernel.org/stable/c/5a92cb45e34749865d03daf8d3500f77b5f6644c | kernel.org | Patch |
| https://git.kernel.org/stable/c/7f4f7efe7f30edd29c4988de01728bf2398217e4 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a096b6e34f602950af9a2b0856cd93a5f4c276d7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c7b7ec3e69e673c0d6b57f74d21da50c485c598e | kernel.org | Patch |
| https://git.kernel.org/stable/c/cb549df9ce4ee15c9d5b19ddab12cf2128e4313c | kernel.org | Patch |
| https://git.kernel.org/stable/c/e917d0c69f01af2bb4fbea2b66d560a53b3ac7ec | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.9, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.1.176 >= 6.2, < 6.6.143 >= 6.7, < 6.12.93 >= 6.13, < 6.18.35 >= 6.19, < 7.0.12 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | CVE Modified | kernel.org |
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 7, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | kernel.org |
| Jul 19, 2026 | New CVE Received | kernel.org |