Potential Use-After-Free Vulnerability in Linux Kernel Network Handling

CVE-2026-63994

What is CVE-2026-63994?

A vulnerability in the Linux kernel's handling of network headers has been identified where the functions iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() cache the IP headers prior to executing the skb_cow() call for socket buffer management. This improper sequence could potentially lead to a Use-After-Free scenario due to the possibility of skb->head being reallocated during the skb_cow() process. The issue has been mitigated by ensuring that local variables are initialized after the skb_cow() call, and unnecessary skb_reset_network_header() calls have been removed to enhance network handling efficiency.

References