CVE-2026-63994
A critical vulnerability in the Linux kernel could allow an attacker to cause a use‑after‑free by exploiting a timing issue in the IP tunnel code. The flaw was fixed by reordering code that accesses packet headers after a memory copy operation.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel users that run a kernel version before the fix. The exact affected versions are not listed, but any kernel lacking the patch is vulnerable.
Real-world impact
An attacker could crash the kernel or potentially execute arbitrary code with kernel privileges, leading to a complete compromise of the affected system.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network, requires no user interaction, and can lead to full compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the patch that reorders header initialization after skb_cow().
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/50750d86a2e5266aba…
- git.kernel.org/stable/c/6dff77899b9e9fe5d8…
- git.kernel.org/stable/c/7254aef4d1a7e18e88…
- git.kernel.org/stable/c/76cd9398a0470257ab…
- git.kernel.org/stable/c/95b6d772bfe788331d…
- git.kernel.org/stable/c/b4bc94353050b1fa7b…
- git.kernel.org/stable/c/bf8b3f34c37c162357…
- git.kernel.org/stable/c/f3f204541f280a6ecb…