CVE-2026-53221
published 2026-06-25CVE-2026-53221: In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.56%
43.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
In vti6_tnl_lookup(), when an exact match for a tunnel fails,
the code falls back to searching for wildcard tunnels:
- Tunnels matching the packet's local address, with any remote address
wildcard remote).
- Tunnels matching the packet's remote address, with any local address
(wildcard local).
However, vti6 stores all these different types of tunnels in the same
hash table (ip6n->tnls_r_l) prone to hash collisions.
The bug is that the fallback search loops in vti6_tnl_lookup() were
missing checks to ensure that the candidate tunnel actually has
a wildcard address.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < c327fa4fca31415431202e063767a7ae342e19c6 | c327fa4fca31415431202e063767a7ae342e19c6 |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < fc657ac0767c49839b3ef0b08dc0953ca30883f8 | fc657ac0767c49839b3ef0b08dc0953ca30883f8 |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < 47fb3c2b4203556308e64354b3e78f2ce221d646 | 47fb3c2b4203556308e64354b3e78f2ce221d646 |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < f513f308cc4bdb4530d033431592ffbc29b7fca1 | f513f308cc4bdb4530d033431592ffbc29b7fca1 |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < 90fd4513315ca07da99cfd8549d3e553a7160f0d | 90fd4513315ca07da99cfd8549d3e553a7160f0d |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < 2abfb19bbb81958714ad1d43ebeb65b30394184b | 2abfb19bbb81958714ad1d43ebeb65b30394184b |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < 2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d | 2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d |
| linux | linux | >= fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 < a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9 | a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.19 < 5.10.259 | 5.10.259 |
| linux | linux_kernel | >= 5.11 < 5.15.210 | 5.15.210 |
| linux | linux_kernel | >= 5.16 < 6.1.176 | 6.1.176 |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
vendor_redhat·2026-06-25·CVSS 5.5
CVE-2026-53221 [MEDIUM] CWE-1289 kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
A flaw was found in the Linux kernel, specifically within the `ip6_vti` component responsible for managing IPv6 tunnels. This vulnerability arises from an error in the `vti6_tnl_lookup()` function, which incorrectly matches network tunnels by failing to properly verify wildcard addresses during fallback searches. This can lead to network traffic being misdirected or dropped, potentially disrupting network services. The underlying cause is a lack of checks to confirm that a candidate tunnel indeed has a wildcard address.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code
ghsa_unreviewed·2026-06-25
CVE-2026-53221 In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
In vti6_tnl_lookup(), when an exact match for a tunnel fails,
the code falls back to searching for wildcard tunnels:
- Tunnels matching the packet's local address, with any remote address
wildcard remote).
- Tunnels matching the packet's remote address, with any local address
(wildcard local).
However, vti6 stores all these different types of tunnels in the same
hash table (ip6n->tnls_r_l) prone to hash collisions.
The bug is that the fallback search loops in vti6_tnl_lookup() were
missing checks to ensure that the candidate tunnel actually has
a wildcard address.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2abfb19bbb81958714ad1d43ebeb65b30394184bhttps://git.kernel.org/stable/c/2fc7bc087cc7085368263d9d37bfe9a0bddd6a2dhttps://git.kernel.org/stable/c/47fb3c2b4203556308e64354b3e78f2ce221d646https://git.kernel.org/stable/c/90fd4513315ca07da99cfd8549d3e553a7160f0dhttps://git.kernel.org/stable/c/a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9https://git.kernel.org/stable/c/c327fa4fca31415431202e063767a7ae342e19c6https://git.kernel.org/stable/c/f513f308cc4bdb4530d033431592ffbc29b7fca1https://git.kernel.org/stable/c/fc657ac0767c49839b3ef0b08dc0953ca30883f8
2026-06-25
Published