CRITICAL Introduced in 5.9
vxlan PMTU UAF
CVE-2026-63993
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI9.8CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the Linux kernel VXLAN driver allows a remote attacker to trigger memory corruption by sending packets that cause PMTU discovery processing. The bug occurs because a cached pointer to the IP header becomes stale after skb_tunnel_check_pmtu() may reallocate the socket buffer's head, leading to potential heap corruption, information disclosure, or kernel crash. Industry convention presumes attacker-reachable heap corruption is exploitable for both reads and writes.
Vulnerability analysis
The root cause is that vxlan_xmit_one() caches the IP header pointer as old_iph before calling skb_tunnel_check_pmtu(), which can reallocate skb->head (e.g., via pskb_expand_head). After this reallocation, old_iph points to freed memory. The stale pointer is then passed to ip_tunnel_ecn_encap() in two code paths (IPv4 and IPv6 outer encapsulation). This constitutes a use-after-free on a heap object. The fix replaces old_iph with ip_hdr(skb), which recomputes the header pointer from the current skb->head, consistent with how bareudp.c and geneve.c handle the same pattern. The attack surface is network-reachable: an attacker can send crafted packets through a VXLAN tunnel endpoint that trigger PMTU processing, causing the skb reallocation and subsequent UAF. No authentication or privileges are required from the network perspective, though the system must be configured as a VXLAN endpoint.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 5.9 | 6.18.35 | 5303925e3605 |
| 6.12 | 5.9 | 6.12.93 | 609e63312c29 |
| 5.10 | 5.9 | 5.10.259 | 6b8bfce9d2f7 |
| 7.0 | 5.9 | 7.0.12 | a493efd4336c |
| 6.6 | 5.9 | 6.6.143 | dc3bfa050f87 |
| mainline | 5.9 | 7.1 | 7d9ef0cb2715 |
| 6.1 | 5.9 | 6.1.176 | 8d435d68d71f |
| 5.15 | 5.9 | 5.15.210 | 9257f56ac47e |