CVE-2026-63993

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) module. This vulnerability occurs because a cached IP header pointer is improperly reused after a Path Maximum Transmission Unit (PMTU) check. When the packet's head is modified during the PMTU check, the old cached IP header pointer becomes invalid, leading to a Use-After-Free (UAF) condition. This memory corruption flaw can potentially allow an attacker to cause a system crash or execute arbitrary code.

This vulnerability is rated as having an Important impact because successful exploitation of memory corruption within the kernel networking stack can result in a denial of service or potential elevation of privileges. In standard Red Hat Enterprise Linux deployments, exposure is limited to environments where VXLAN tunneling interfaces are actively configured and processing encapsulated packets undergoing Path MTU discovery. Earlier enterprise releases, such as Red Hat Enterprise Linux 8, do not include the vulnerable code path and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.