In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some… (CVE-2026-63992)
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.
AI Analysis
Technical Summary
The Linux kernel contained a vulnerability in the iptunnel_pmtud_check_icmp() function where it assumed the presence of a transport header in the skb structure. In some cases, this assumption was invalid, causing an out-of-bound memory access because the transport header offset was set to an invalid value (65535). The vulnerability was addressed by modifying the code to access the ICMP header based on the IPv4 network header after confirming the ICMP type is present in the skb linear part. The IPv6 equivalent function was not vulnerable.
Potential Impact
This vulnerability could lead to out-of-bound memory access in the Linux kernel, which may cause kernel crashes or potentially allow attackers to influence kernel behavior. No known exploits in the wild have been reported. The impact is limited to scenarios where the vulnerable function is called with an unset transport header in skb.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability. Users should apply the official kernel updates that include this patch. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some… (CVE-2026-63992)
Description
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel contained a vulnerability in the iptunnel_pmtud_check_icmp() function where it assumed the presence of a transport header in the skb structure. In some cases, this assumption was invalid, causing an out-of-bound memory access because the transport header offset was set to an invalid value (65535). The vulnerability was addressed by modifying the code to access the ICMP header based on the IPv4 network header after confirming the ICMP type is present in the skb linear part. The IPv6 equivalent function was not vulnerable.
Potential Impact
This vulnerability could lead to out-of-bound memory access in the Linux kernel, which may cause kernel crashes or potentially allow attackers to influence kernel behavior. No known exploits in the wild have been reported. The impact is limited to scenarios where the vulnerable function is called with an unset transport header in skb.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability. Users should apply the official kernel updates that include this patch. Since this is a kernel-level issue, updating to the patched kernel version is the recommended remediation. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9cmp-wxh9-77q4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63992"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27aa2a4a8d598912df25
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 07/19/2026, 20:02:10 UTC
Last updated: 07/20/2026, 21:51:26 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.