Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-53221

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

Ver en NVD

Análisis

A critical vulnerability (CVSS 9.8) has been identified in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) logic. Incorrect tunnel matching in the networking stack could allow an attacker to bypass security boundaries or potentially achieve remote exploitation on systems utilizing IPv6 tunneling.

Roles relevantes

LinuxBackendCyberSecurityCloudKubernetesDocker

Severidad

Puntaje: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH

EPSS

Probabilidad de explotación (próx. 30 días): 0.0018 (0.2%)
Percentil: 8.2%
EPSS: 2026-06-27

Descripción técnica

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

Publicada: 25/6/2026, 9:16:39
Última modificación: 28/6/2026, 8:16:39

Referencias

InicioEventosBlogRecursosEquipo