exploitDog

CVE-2026-63994

Опубликовано: 19 июл. 2026

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6

Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head.

Fix this possible UAF by initializing the local variables after the skb_cow() call.

Remove skb_reset_network_header() calls which were not needed.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.9 (включая) до 5.10.259 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.11 (включая) до 5.15.210 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.16 (включая) до 6.1.176 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.2 (включая) до 6.6.143 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.7 (включая) до 6.12.93 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.13 (включая) до 6.18.35 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.19 (включая) до 7.0.12 (исключая)

cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*

EPSS

Процентиль: 42%

0.00514

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-416

Связанные уязвимости

CVE-2026-63994

CVSS3: 9.8

ubuntu

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.

CVE-2026-63994

CVSS3: 7

redhat

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.

CVE-2026-63994

CVSS3: 9.8

debian

3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: t ...

ROS-20260930-80-0135

CVSS3: 9.8

redos

13 дней назад

Уязвимость kernel-lt

ROS-20260930-73-0097

CVSS3: 9.8

redos

13 дней назад

Уязвимость kernel-lt

EPSS

Процентиль: 42%

0.00514

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-416