Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a remote attacker to cause a system crash or access restricted memory. This issue occurs when the system processes specific network tunnel traffic, potentially leading to an unstable operating environment. Administrators should apply kernel updates to ensure continued system availability and security.
Technical details
An out-of-bounds access vulnerability exists in the iptunnel_pmtud_check_icmp() function in net/ipv4/ip_tunnel_core.c. The issue arises because the code assumes the skb transport header is set, but in certain bridged IP packet scenarios, it may be uninitialized (returning a value of 65535). This leads to an invalid memory access when attempting to read the ICMP header. The fix involves validating the ICMP header presence relative to the IPv4 network header and ensuring the ICMP type is within the linear part of the socket buffer. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux 5.9 to 5.10.258, 5.15.209, 6.1.175, 6.6.105, 6.12.15, 6.13.3
Timeline
- 2026-05-22: disclosed: Initial patch submitted by Eric Dumazet
- 2026-07-19: advisory: CVE-2026-63992 published
References
- https://git.kernel.org/stable/c/43368636c663cff6e59dde93cf4b8e43ac28eb93
- https://git.kernel.org/stable/c/509323077ef79a26ba0c60bb556e45c12c398b2d
- https://git.kernel.org/stable/c/5a92cb45e34749865d03daf8d3500f77b5f6644c
- https://git.kernel.org/stable/c/7f4f7efe7f30edd29c4988de01728bf2398217e4
- https://git.kernel.org/stable/c/a096b6e34f602950af9a2b0856cd93a5f4c276d7
- https://git.kernel.org/stable/c/c7b7ec3e69e673c0d6b57f74d21da50c485c598e
- https://git.kernel.org/stable/c/cb549df9ce4ee15c9d5b19ddab12cf2128e4313c