CVE-2026-63994: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63994 Overview

CVE-2026-63994 is a use-after-free vulnerability in the Linux kernel's IP tunneling subsystem. The flaw exists in iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6(), which cached pointers returned by ip_hdr() and ipv6_hdr() before calling skb_cow(). Because skb_cow() can reallocate skb->head, the previously cached header pointers become dangling references to freed memory. Subsequent access to these pointers can lead to memory corruption during Path MTU discovery (PMTUD) ICMP message construction on tunnel interfaces.

Critical Impact
Remote attackers can trigger a use-after-free in the kernel network stack by sending traffic that induces PMTUD ICMP generation on tunnel devices, potentially leading to memory corruption or code execution.

Affected Products

Linux kernel versions containing iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6()
Systems using IP-in-IP, GRE, or other tunnel drivers relying on tunnel PMTU helpers
Distributions shipping kernels prior to the fixes referenced in the upstream commits

Discovery Timeline

2026-07-19 - CVE-2026-63994 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63994

Vulnerability Analysis

The vulnerability is a classic use-after-free (UAF) [CWE-416] in the Linux kernel tunneling code. During Path MTU discovery, the kernel builds ICMP or ICMPv6 "Fragmentation Needed" / "Packet Too Big" replies to inform the sender that packets exceed the tunnel MTU.

The original code retrieved the network header pointers using ip_hdr(skb) or ipv6_hdr(skb) and stored them in local variables. It then called skb_cow() to ensure the socket buffer had enough headroom and was writable. skb_cow() may reallocate skb->head, invalidating any previously computed pointer into the packet.

Any subsequent dereference of the stale header pointer accesses freed memory. This can be leveraged for information disclosure or, depending on allocator state, memory corruption within kernel address space.

Root Cause

The root cause is incorrect pointer lifetime management around an operation that can reallocate the underlying buffer. Header pointers must be recomputed after any function that may relocate skb->head. The fix moves the initialization of local header variables to after the skb_cow() call and removes redundant skb_reset_network_header() invocations.

Attack Vector

An unauthenticated remote attacker sends network traffic across a tunnel interface that triggers Path MTU discovery. When the kernel constructs the ICMP or ICMPv6 error message in response, the vulnerable code path dereferences the freed header pointer. Because the trigger is over the network without user interaction, exploitation does not require local access.

The vulnerability is described in the kernel source in the affected functions. Refer to the upstream commits for the precise code change: Kernel Git Commit 50750d86 and Kernel Git Commit f3f20454.

Detection Methods for CVE-2026-63994

Indicators of Compromise

Kernel oops or panic messages referencing iptunnel_pmtud_build_icmp or iptunnel_pmtud_build_icmpv6 in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads in the tunnel PMTU code path on debug kernels
Unexpected reboots or hangs on hosts terminating IP-in-IP, GRE, or IPv6 tunnels under fragmentation-triggering traffic

Detection Strategies

Inventory kernel versions across Linux fleet and compare against the fixed commits referenced in stable trees
Monitor kernel crash telemetry for stack traces implicating tunnel PMTU functions
Enable KASAN in test environments to surface UAF conditions during network stress testing

Monitoring Recommendations

Forward kernel.* syslog facility to a centralized log store and alert on crash signatures involving tunnel code
Track tunnel interface counters (ip -s tunnel show) for anomalous ICMP error generation rates
Correlate host reboots with preceding traffic bursts on tunnel devices to identify potential exploitation attempts

How to Mitigate CVE-2026-63994

Immediate Actions Required

Apply the upstream kernel patches or update to a distribution kernel that incorporates the fix
Prioritize hosts that terminate IP tunnels exposed to untrusted networks such as VPN concentrators and edge routers
Reboot patched systems to ensure the vulnerable kernel image is no longer running

Patch Information

The fix reinitializes local header variables after skb_cow() and removes unnecessary skb_reset_network_header() calls. The change has been merged into multiple stable branches. Reference commits include Kernel Git Commit 50750d86, Kernel Git Commit 6dff7789, Kernel Git Commit 7254aef4, Kernel Git Commit 76cd9398, Kernel Git Commit 95b6d772, Kernel Git Commit b4bc9435, Kernel Git Commit bf8b3f34, and Kernel Git Commit f3f20454.

Workarounds

Disable unused tunnel interfaces where feasible using ip link set <tunnel> down to remove the attack surface
Restrict inbound traffic that can induce PMTUD responses on tunnel endpoints via ingress filtering at network borders
Rate-limit ICMP and ICMPv6 error generation on affected hosts to reduce exploitation attempts pending patch deployment

bash

# Verify running kernel version and check for the fix
uname -r

# List active tunnel interfaces
ip -d link show type ipip
ip -d link show type gre
ip -d link show type ip6tnl

# Temporarily disable an unused tunnel interface
sudo ip link set tun0 down