EUVD-2026-64392
GHSA-rcm8-q4cm-988v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-triggered via tunnel packets (AV:N) but requires non-default tunnel config plus a realloc race (AC:H); primary impact is a kernel crash (A:H) with possible limited memory disclosure (C:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
udp: fix potential use-after-free in tunnel segmentation
__skb_udp_tunnel_segment() gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb->head, the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
AnalysisAI
Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The host must be processing UDP tunnel traffic through the software segmentation/GSO path - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) is the automated maximal score the Linux CNA routinely assigns to kernel memory-safety bugs and substantially overstates real-world risk here. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker able to send UDP-encapsulated tunnel packets to a host that software-segments them (e.g. a VXLAN/GENEVE gateway or hypervisor) crafts traffic that forces skb->head to be reallocated during the tunnel-header pull, causing the kernel to dereference the stale UDP header pointer. … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or mainline 7.2 (or later on your series) - via your distribution's kernel update, then reboot (or apply a vendor live-patch if available). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems running UDP tunnel software segmentation, particularly hypervisors, network appliances, and SD-WAN platforms using VXLAN, GENEVE, or FoU. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today