CVE-2026-63992: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63992 Overview

CVE-2026-63992 is a Linux kernel vulnerability in the IP tunnel path MTU discovery (PMTUD) code. The flaw resides in iptunnel_pmtud_check_icmp(), which assumes the socket buffer (skb) transport header is set before dereferencing it. When the transport header is uninitialized, its value is (typeof(skb->transport_header))~0U, which equals 65535, causing an out-of-bounds access when the kernel reads the ICMP header at that offset.

The issue was resolved by accessing the ICMP header based on the IPv4 network header and validating that icmp->type resides in the skb linear portion. The companion function iptunnel_pmtud_check_icmpv6() is unaffected.

Critical Impact
A remote attacker can trigger out-of-bounds memory access in the kernel network stack over tunnel interfaces, leading to kernel memory disclosure or denial of service without authentication.

Affected Products

Linux kernel versions containing the iptunnel_pmtud_check_icmp() function prior to the fix commits
Systems using IP tunnel interfaces (GRE, IPIP, SIT, and related tunnel drivers) that invoke PMTU discovery on ICMP-triggered paths
Distributions shipping the vulnerable stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-07-19 - CVE-2026-63992 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63992

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Linux kernel IP tunnel path MTU discovery handler. iptunnel_pmtud_check_icmp() is invoked when the kernel needs to inspect an inner ICMP payload to determine whether a PMTU update should be propagated across a tunnel. The function reads the ICMP header via skb->transport_header, expecting that upstream code has already set this offset.

In several code paths, the function is reached while the transport header offset is uninitialized. The Linux skb transport header field is an unsigned integer type that defaults to ~0U, or 65535 when truncated. Dereferencing that offset causes the kernel to read data far outside the packet buffer's linear region.

The patched code no longer trusts skb->transport_header. Instead, it locates the ICMP header using the IPv4 network header offset plus the IPv4 header length, then verifies that at least the byte containing icmp->type is present in the linear part of the skb before dereferencing it.

Root Cause

The root cause is an unchecked assumption that the transport header offset in the sk_buff structure is valid. When a caller reaches iptunnel_pmtud_check_icmp() without having parsed and set the transport layer offset, the sentinel value 65535 is used as a byte offset into the packet, producing an out-of-bounds access relative to the packet linear buffer.

Attack Vector

An unauthenticated remote attacker can send crafted ICMP or tunneled packets to a host that terminates or forwards IP tunnels. If the packet reaches the PMTUD check path before the transport header is set, the kernel performs an out-of-bounds read. Depending on adjacent memory layout, this can crash the kernel (denial of service) or leak kernel memory contents used in subsequent tunnel error reporting.

The vulnerability manifests entirely within kernel packet processing and requires no local access or user interaction. See the upstream fix commits referenced in Linux Kernel Commit 5a92cb45 and Linux Kernel Commit e917d0c6 for the exact code paths and validation logic.

Detection Methods for CVE-2026-63992

Indicators of Compromise

Unexpected kernel oops or panic messages referencing iptunnel_pmtud_check_icmp in dmesg or /var/log/kern.log
KASAN reports flagging out-of-bounds reads within the IP tunnel PMTUD code path
Sudden reboots or network stack instability on hosts terminating GRE, IPIP, or SIT tunnels
Bursts of malformed ICMP fragmentation-needed packets arriving on tunnel interfaces

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds accesses in net/ipv4/ip_tunnel_core.c during validation
Monitor kernel ring buffer logs and forward them to a central log store for pattern matching on tunnel-related stack traces
Track version metadata of running kernels across the fleet and flag hosts on unpatched stable branches

Monitoring Recommendations

Alert on unexpected kernel crashes on hosts that terminate IP tunnels, especially border routers and VPN concentrators
Baseline ICMP traffic volumes toward tunnel endpoints and alert on anomalous spikes of type 3 (destination unreachable) messages
Collect and retain kdump cores from Linux hosts so that suspected exploitation attempts can be triaged post-incident

How to Mitigate CVE-2026-63992

Immediate Actions Required

Inventory Linux hosts running vulnerable stable kernel branches and prioritize those exposing tunnel interfaces to untrusted networks
Apply the upstream stable kernel updates that include the referenced fix commits as soon as your distribution ships them
Restrict ingress of ICMP fragmentation-needed messages on tunnel interfaces to trusted peers where operationally feasible
Reboot patched hosts to ensure the fixed kernel is active, since live-patching coverage may vary by distribution

Patch Information

The fix is distributed across multiple stable branches through the following upstream commits: Linux Kernel Commit 43368636, Linux Kernel Commit 50932307, Linux Kernel Commit 5a92cb45, Linux Kernel Commit 7f4f7efe, Linux Kernel Commit a096b6e3, Linux Kernel Commit c7b7ec3e, Linux Kernel Commit cb549df9, and Linux Kernel Commit e917d0c6. Consume these fixes via your Linux distribution's official kernel update channel.

Workarounds

Disable unused IP tunnel modules (ip_tunnel, ipip, sit, ip_gre) on hosts that do not require them by blacklisting them in /etc/modprobe.d/
Filter untrusted ICMP traffic destined to tunnel endpoints using iptables or nftables firewall rules
Segment tunnel-terminating hosts behind upstream filtering so that only known peers can deliver ICMP error messages

bash

# Configuration example: block untrusted modules and filter ICMP to tunnel endpoints
echo 'install ipip /bin/true'  | sudo tee /etc/modprobe.d/disable-ipip.conf
echo 'install sit  /bin/true'  | sudo tee /etc/modprobe.d/disable-sit.conf
echo 'install ip_gre /bin/true' | sudo tee /etc/modprobe.d/disable-gre.conf

# Restrict ICMP fragmentation-needed messages to trusted peers only
sudo nft add rule inet filter input iifname "gre0" icmp type destination-unreachable ip saddr != 203.0.113.0/24 drop