9.1

CVE-2026-63992: linux Out-of-bounds Read

CVSS: 9.1v3.1CriticalModified
AliasesUBUNTU-CVE-2026-63992DEBIAN-CVE-2026-63992
Published 19-07-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-63992 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 43 · Related 40
OPENSUSE-SU-2026:21910-1RHSA-2026:75746RHSA-2026:75747RHSA-2026:76739SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-bound access, because (typeof(skb->transport_header))~0U is 65535. Access the icmp header based on IPv4 network header, after making sure icmp->type is present in skb linear part. Note that iptunnel_pmtud_check_icmpv6()) is fine.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

0.00 pp

From 0.51% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu155 products
  • linux< 5.15.0-194.204 | < 6.8.0-142.142 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1116.123 | < 6.8.0-1065.68 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 5a92cb45e34749865d03daf8d3500f77b5f6644c | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < c7b7ec3e69e673c0d6b57f74d21da50c485c598e | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 7f4f7efe7f30edd29c4988de01728bf2398217e4 | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < e917d0c69f01af2bb4fbea2b66d560a53b3ac7ec | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < a096b6e34f602950af9a2b0856cd93a5f4c276d7 | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 43368636c663cff6e59dde93cf4b8e43ac28eb93 | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < cb549df9ce4ee15c9d5b19ddab12cf2128e4313c | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 509323077ef79a26ba0c60bb556e45c12c398b2d | 5.9
  • linux_kernel≥ 5.9, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.93 | ≥ 6.13, < 6.18.35 | ≥ 6.19, < 7.0.12 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1

3 vendors · 158 products

References

36 links
Show all 36 references