What is the CVSS score of CVE-2026-63993?

CVE-2026-63993 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63993?

A critical use-after-free vulnerability in Linux kernel VXLAN overlay networking (CVE-2026-63993, CVSS 9.8) can cause kernel memory corruption, system crashes, and information disclosure on any host…. A patch is available.

How to fix or mitigate CVE-2026-63993?

Within 24 hours, inventory all hosts using VXLAN tunnels across production data centers and cloud environments. Within 7 days, begin staged patching starting with the most critical infrastructure, applying kernel updates to versions 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12, or 7.1 depending on your current kernel branch, coordinating with operations to schedule system reboots during maintenance windows. Within 30 days, complete patching across all affected systems and verify via kernel version checks that all VXLAN-using hosts are running patched kernel versions.

Linux Kernel CVE-2026-63993

EUVD-2026-45566 CRITICAL

2026-07-19 Linux

GHSA-p6vc-4hvx-xvcw

Information Disclosure Linux

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Reaching the UAF needs a configured VXLAN tunnel and a size-dependent skb reallocation, so AV:A and AC:H; primary realistic impact is DoS (A:H) with possible info leak (C:L).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:43 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:56 cve.org

CRITICAL 9.8

CVE Published

Jul 19, 2026 - 14:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

skb_tunnel_check_pmtu() can change skb->head.

Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF.

Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c.

Found by Sashiko.

AnalysisAI

Use-after-free in the Linux kernel's VXLAN tunnel driver (drivers/net/vxlan) arises because the transmit path caches the result of ip_hdr() into old_iph and reuses it after skb_tunnel_check_pmtu(), which may reallocate skb->head and invalidate that pointer. Affected are kernels from 5.9 through the fix commits (patched in 6.1.176, 6.6.143, 6.12.93, 5.15.210, 5.10.259, 6.18.35, 7.0.12 and 7.1) on hosts using VXLAN overlays; an attacker able to drive traffic through the tunnel can trigger memory corruption leading to information disclosure or a kernel crash. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 7th percentile), so this is not currently associated with active exploitation despite the CVSS 9.8 rating.

Technical ContextAI

VXLAN (Virtual eXtensible LAN, RFC 7348) is a Layer-2-over-UDP overlay tunneling technology heavily used in cloud, container and datacenter fabrics to build virtual networks. In the kernel's vxlan_xmit path, ip_hdr(skb) is dereferenced and stashed in a local variable (old_iph) before calling skb_tunnel_check_pmtu(), a helper that validates path-MTU and can grow/reallocate the socket buffer's linear data area (skb->head). Once skb->head moves, the previously cached header pointer dangles, so any subsequent read/write through it is a use-after-free - the classic CWE-416 root cause (the input lists CWE as N/A, but the description is unambiguously a UAF; vendor tags additionally flag Information Disclosure). The fix mirrors the already-correct pattern in bareudp.c and geneve.c: re-fetch ip_hdr(skb) after the PMTU check instead of trusting the stale pointer. The issue was discovered by the 'Sashiko' fuzzing/analysis tooling.

RemediationAI

Vendor-released patch: update to a kernel that includes the fix for your series - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 or later - or apply the corresponding stable commit from git.kernel.org (for example https://git.kernel.org/stable/c/6b8bfce9d2f774d2c2243e0248e03efb99bba6c0), then reboot into the patched kernel. Consult your distribution's advisory for the exact backported package version, and reference https://nvd.nist.gov/vuln/detail/CVE-2026-63993. If immediate patching is not possible, the most effective compensating control is to avoid the vulnerable code path: on hosts that do not require overlay networking, do not configure VXLAN interfaces (or unload/blacklist the vxlan module), which fully eliminates exposure but breaks any VXLAN-based overlay connectivity; where VXLAN is required, restrict which peers can send tunnel traffic to the host (firewall the VXLAN UDP port, default 4789, to trusted overlay endpoints only) to limit who can attempt to trigger the PMTU/skb-reallocation condition, at the cost of tighter network segmentation management. These are mitigations, not fixes - patching is the durable remedy.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63993 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63993

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code