What is the CVSS score of CVE-2026-63992?

CVE-2026-63992 has a contested CVSS base score of 9.1 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-63992?

A critical Linux kernel vulnerability (CVE-2026-63992) in IPv4 tunnel path-MTU discovery could allow remote attackers to leak sensitive kernel memory or crash tunnel endpoints via crafted ICMP…. A patch is available.

How to fix or mitigate CVE-2026-63992?

Within 24 hours, complete an inventory of all Linux systems with IPv4 tunnel interfaces (sit, ipip, gre, erspan) and classify by internet exposure and criticality. Within 7 days, apply the available Linux kernel vendor patch to all identified systems; for any systems that cannot be immediately patched, implement firewall rules to restrict ICMP traffic to tunnel endpoints as a temporary mitigation. Within 30 days, verify patch deployment across 100% of affected systems and document the remediation status for compliance records.

Linux Kernel CVE-2026-63992

EUVD-2026-45565 CRITICAL

2026-07-19 Linux

GHSA-9cmp-wxh9-77q4

Information Disclosure Linux

Critical

Disputed · 9.1 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

6.5 MEDIUM

Remote unauthenticated ICMP trigger (AV:N/PR:N) but requires the situational unset-transport-header path (AC:H); out-of-bounds read yields limited disclosure (C:L) and reliable crash (A:H), no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:42 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.1 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:56 cve.org

CRITICAL 9.1

CVE Published

Jul 19, 2026 - 14:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set.

This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535.

Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part.

Note that iptunnel_pmtud_check_icmpv6()) is fine.

AnalysisAI

Out-of-bounds memory access in the Linux kernel's IP tunnel path-MTU discovery code (iptunnel_pmtud_check_icmp) affects IPv4 tunnel interfaces where the function may run on packets whose skb transport header is unset, causing an ~65535-byte offset read past the linear buffer. Remote attackers can trigger this by sending crafted ICMP traffic to a tunnel endpoint, potentially leaking adjacent kernel memory or crashing the host (denial of service). This is a supplier-reported (Linux stable) fix with no public exploit identified at time of analysis and a low EPSS score of 0.18%.

Technical ContextAI

The flaw lives in net/ipv4 IP tunnel handling (GRE/IPIP/SIT-style encapsulation) where iptunnel_pmtud_check_icmp() inspects an inner ICMP error to drive path-MTU discovery. The code assumed skb->transport_header was always set, but in some receive paths it is not; because the header offset is a 16-bit field, an unset value is (typeof)~0U == 65535, so dereferencing the 'ICMP header' reads far outside the packet's linear data. The corrected code instead locates the ICMP header relative to the IPv4 network header and validates that icmp->type is within the skb linear region before access. The root-cause class is an out-of-bounds read (CWE-125, though CWE is marked N/A in the feed), a classic bounds/assumption error in packet parsing. Per the CPE data the affected component is the mainline linux:linux package; the companion IPv6 helper iptunnel_pmtud_check_icmpv6() was already correct.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (or your distribution's build incorporating the corresponding git.kernel.org stable commit, e.g. c7b7ec3e69e6 / 509323077ef7). Apply the vendor kernel update through your distribution's channel and reboot. If immediate patching is not possible, reduce exposure by tearing down or restricting IPv4 tunnel interfaces that are not required (ip tunnel del / disable unused GRE/IPIP/SIT), and filter untrusted ICMP toward tunnel endpoints at the network edge - noting the trade-off that ICMP filtering can impair legitimate path-MTU discovery and fragmentation handling. These are compensating controls only; the kernel upgrade is the definitive fix. Patch commits are enumerated at https://git.kernel.org/stable/ (see the listed hashes).

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63992 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63992

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code