PT-2026-61310 · Linux · Linux Kernel

CVE-2026-63993 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Use-After-Free (UAF) issue exists in the vxlan component. The problem occurs when a cached ip hdr() value is reused after the skb tunnel check pmtu() function is called, as this function can change the skb->head pointer. Use-After-Free is a condition where a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63993

Affected Products

Linux Kernel

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-63993 · Security Note
• https://git.kernel.org/stable/c/a493efd4336cf19122ae0e4cbb3d31b32d70deea · Note
• https://git.kernel.org/stable/c/dc3bfa050f873371e745bdf478b1f5b738e5733d · Note
• https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0 · Note
• https://git.kernel.org/stable/c/9257f56ac47ef1976bcd056cf986a9988eeec67a · Note
• https://twitter.com/CVEnew/status/2078861457681215804 · Twitter Post
• https://git.kernel.org/stable/c/7d9ef0cb271555d8cf39fefe6c981e1493b25ecf · Note
• https://git.kernel.org/stable/c/609e63312c29aad18026a1d3222e123d4b6b0feb · Note
• https://git.kernel.org/stable/c/8d435d68d71fb875876b722f4136caf74f2f48bd · Note
• https://git.kernel.org/stable/c/5303925e360527243b46a440a04667826bbc72b7 · Note
• https://twitter.com/infoflowcloud/status/2078862731818545283 · Twitter Post