Riskcovery

CVE-2026-53221

ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

State
Published
Severity
9.8 Critical
Published
Jun 25, 2026
Updated
Oct 19, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:

- Tunnels matching the packet's local address, with any remote address wildcard remote).

- Tunnels matching the packet's remote address, with any local address (wildcard local).

However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.

The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
LinuxLinux
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before c327fa4fca31415431202e063767a7ae342e19c6Affected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before fc657ac0767c49839b3ef0b08dc0953ca30883f8Affected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before 47fb3c2b4203556308e64354b3e78f2ce221d646Affected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before f513f308cc4bdb4530d033431592ffbc29b7fca1Affected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before 90fd4513315ca07da99cfd8549d3e553a7160f0dAffected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before 2abfb19bbb81958714ad1d43ebeb65b30394184bAffected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before 2fc7bc087cc7085368263d9d37bfe9a0bddd6a2dAffected
  • fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 to before a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9Affected
LinuxLinux
  • 3.19Affected
  • before 3.19Not affected
  • 5.10.259 through 5.10.*Not affected
  • 5.15.210 through 5.15.*Not affected
  • 6.1.176 through 6.1.*Not affected
  • 6.6.143 through 6.6.*Not affected
  • 6.12.94 through 6.12.*Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.