Bug 2502369 (CVE-2026-63993)

Summary:	CVE-2026-63993 kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) module. This vulnerability occurs because a cached IP header pointer is improperly reused after a Path Maximum Transmission Unit (PMTU) check. When the packet's head is modified during the PMTU check, the old cached IP header pointer becomes invalid, leading to a Use-After-Free (UAF) condition. This memory corruption flaw can potentially allow an attacker to cause a system crash or execute arbitrary code.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:04:23 UTC

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c
and drivers/net/geneve.c.

Found by Sashiko.

Comment 1 Keith Grant 2026-07-21 23:48:28 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071905-CVE-2026-63993-165e@gregkh/T

Comment 4 errata-xmlrpc 2026-09-08 07:19:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:64775 https://access.redhat.com/errata/RHSA-2026:64775

Comment 6 Jon Orris 2026-10-08 09:50:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:76739 https://access.redhat.com/errata/RHSA-2026:76739

Comment 7 Jon Orris 2026-10-16 13:30:17 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:83707 https://access.redhat.com/errata/RHSA-2026:83707

Comment 10 Jon Orris 2026-10-28 01:10:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:91489 https://access.redhat.com/errata/RHSA-2026:91489

Comment 11 Jon Orris 2026-10-28 01:14:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:91492 https://access.redhat.com/errata/RHSA-2026:91492

Comment 12 Jon Orris 2026-10-30 06:30:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:92993 https://access.redhat.com/errata/RHSA-2026:92993

Comment 13 Jon Orris 2026-10-30 13:05:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:93047 https://access.redhat.com/errata/RHSA-2026:93047