9.8

CVE-2026-63993: linux Use After Free

CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2026-63993DEBIAN-CVE-2026-63993
Published 19-07-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-63993 is a critical (CVSS 9.8) Use After Free vulnerability in linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 34 · Related 31
OPENSUSE-SU-2026:21910-1RHSA-2026:64775RHSA-2026:76739RHSA-2026:83707SUSE-SU-2026:23881-1SUSE-SU-2026:23887-1

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instead ip_hdr(skb) as done in drivers/net/bareudp.c and drivers/net/geneve.c. Found by Sashiko.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

0.00 pp

From 0.51% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.51%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu155 products
  • linux< 5.15.0-194.204 | < 6.8.0-142.142 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.15.0-1116.123 | < 6.8.0-1065.68 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 6b8bfce9d2f774d2c2243e0248e03efb99bba6c0 | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 9257f56ac47ef1976bcd056cf986a9988eeec67a | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 8d435d68d71fb875876b722f4136caf74f2f48bd | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < dc3bfa050f873371e745bdf478b1f5b738e5733d | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 609e63312c29aad18026a1d3222e123d4b6b0feb | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 5303925e360527243b46a440a04667826bbc72b7 | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < a493efd4336cf19122ae0e4cbb3d31b32d70deea | ≥ 4cb47a8644cc9eb8ec81190a50e79e6530d0297f, < 7d9ef0cb271555d8cf39fefe6c981e1493b25ecf | 5.9
  • linux_kernel≥ 5.9, < 5.10.259 | ≥ 5.11, < 5.15.210 | ≥ 5.16, < 6.1.176 | ≥ 6.2, < 6.6.143 | ≥ 6.7, < 6.12.93 | ≥ 6.13, < 6.18.35 | ≥ 6.19, < 7.0.12 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3 | 7.1:rc4 | 7.1:rc5
Debian1 product
  • linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1

3 vendors · 158 products

References

36 links
Show all 36 references