Skip to main content

Linux Kernel CVE-2026-53221

| EUVDEUVD-2026-39312 CRITICAL
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-h3c9-j2j5-6mff
Information Disclosure Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable but requires non-default vti6 wildcard tunnels plus an engineered hash collision (AC:H); impact is traffic misdirection/disclosure (C:H, minor I:L), no availability loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:36 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:

  • Tunnels matching the packet's local address, with any remote address

wildcard remote).

  • Tunnels matching the packet's remote address, with any local address

(wildcard local).

However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions.

The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

AnalysisAI

Incorrect tunnel matching in the Linux kernel's IPv6 Virtual Tunnel Interface (vti6) lets the vti6_tnl_lookup() fallback path select the wrong tunnel when an exact match fails, because the wildcard-search loops omitted checks that a candidate tunnel actually holds a wildcard local or remote address. On hosts configured with multiple vti6 tunnels sharing the ip6n->tnls_r_l hash table, hash collisions can cause inbound IPv6/IPsec packets to be associated with an unintended tunnel, enabling traffic misdirection and information disclosure. There is no public exploit identified at time of analysis, EPSS probability is low (0.18%), and the issue is not in CISA KEV; the upstream fix is available across multiple stable kernel branches.

Technical ContextAI

The vulnerability lives in net/ipv6/ip6_vti.c, which implements IPv6 stateless VTI tunnels used to carry IPsec-protected traffic over routable tunnel interfaces. All tunnel types - those keyed by local address with a wildcard remote, and those keyed by remote address with a wildcard local - are stored together in a single hash table (ip6n->tnls_r_l), so distinct tunnels can land in the same hash bucket. When an exact (local,remote) lookup misses, vti6_tnl_lookup() walks the bucket twice looking for wildcard fallbacks, but the loops failed to verify that the matched entry truly has the wildcard address (e.g., an any/zero address) in the dimension being relaxed. As a result a colliding non-wildcard tunnel could be wrongly returned. No CWE was assigned in the input, but the root cause is a logic/validation error in lookup matching (an improper-check / incorrect-comparison class, broadly CWE-697-style logic flaw) rather than a memory-safety bug; the EUVD tags label the impact as Information Disclosure.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later within each branch), matching your distribution's kernel series, then reboot. The underlying fix is also available as upstream commits on git.kernel.org (e.g. fc657ac0767c49839b3ef0b08dc0953ca30883f8 and the sibling stable backports) for teams that build their own kernels. Where immediate patching is not possible, the most effective compensating control is configuration-side: avoid or minimize overlapping wildcard vti6 tunnel definitions on the same host so that local-wildcard and remote-wildcard tunnels are not co-resident in a way that produces ambiguous matches, and where feasible use fully specified (local,remote) tunnel endpoints instead of wildcard endpoints - the trade-off is reduced flexibility for dynamic/roaming peers. If vti6 is not required, unloading or not configuring the ip6_vti functionality removes exposure entirely, at the cost of losing IPv6 VTI tunneling. Consult the per-commit advisories on git.kernel.org and the NVD entry for branch-specific details.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy