Answer in brief
CVE-2026-63994 records a Unknown severity vulnerability in tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6](). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-63994 records a Unknown severity vulnerability in tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6](). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <95b6d772bfe788331d9742d73eaa12e113b2adc4 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <7254aef4d1a7e18e887af9010e2f2dc34806789b || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <bf8b3f34c37c162357138e7c0942723b8b94fed1 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <76cd9398a0470257ab765bdf5f358a2af2e17934 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <50750d86a2e5266aba0c295483b3397843198b11 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <6dff77899b9e9fe5d854abda3a98ad04e7229ef7 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <f3f204541f280a6ecb04503a0d6794d93990ca43 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <b4bc94353050b1fa7b702bd4c6600710dd926cff | 95b6d772bfe788331d9742d73eaa12e113b2adc4, 7254aef4d1a7e18e887af9010e2f2dc34806789b, bf8b3f34c37c162357138e7c0942723b8b94fed1, 76cd9398a0470257ab765bdf5f358a2af2e17934, 50750d86a2e5266aba0c295483b3397843198b11, 6dff77899b9e9fe5d854abda3a98ad04e7229ef7, f3f204541f280a6ecb04503a0d6794d93990ca43, b4bc94353050b1fa7b702bd4c6600710dd926cff |
| Linux/Linuxgeneric | 5.9 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <95b6d772bfe788331d9742d73eaa12e113b2adc4 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <7254aef4d1a7e18e887af9010e2f2dc34806789b || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <bf8b3f34c37c162357138e7c0942723b8b94fed1 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <76cd9398a0470257ab765bdf5f358a2af2e17934 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <50750d86a2e5266aba0c295483b3397843198b11 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <6dff77899b9e9fe5d854abda3a98ad04e7229ef7 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <f3f204541f280a6ecb04503a0d6794d93990ca43 || >=4cb47a8644cc9eb8ec81190a50e79e6530d0297f <b4bc94353050b1fa7b702bd4c6600710dd926cff | 95b6d772bfe788331d9742d73eaa12e113b2adc4, 7254aef4d1a7e18e887af9010e2f2dc34806789b, bf8b3f34c37c162357138e7c0942723b8b94fed1, 76cd9398a0470257ab765bdf5f358a2af2e17934, 50750d86a2e5266aba0c295483b3397843198b11, 6dff77899b9e9fe5d854abda3a98ad04e7229ef7, f3f204541f280a6ecb04503a0d6794d93990ca43, b4bc94353050b1fa7b702bd4c6600710dd926cff |
| Linux/Linuxgeneric | 5.9 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_cow() call. Remove skb_reset_network_header() calls which were not needed.
Quoted source text, attributed separately from HOL analysis.