CVE-2026-53221 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.
A vulnerability exists in the Linux kernel's IP6 VTI (Virtual Tunnel Interface) implementation, specifically within the tunnel lookup function. The issue arises when the function fails to find an exact match for a tunnel; it incorrectly falls back to searching for wildcard tunnels without properly verifying if the candidate tunnel actually has a wildcard address. This flaw can lead to hash collisions, as different types of tunnels are stored in the same hash table. The vulnerability affects the Linux kernel stable tree.
Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed. Instructions for downloading the patched version are available in the Linux kernel repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/2abfb19bbb81958714ad1d43ebeb65b30394184b | kernel.org | Patch |
| https://git.kernel.org/stable/c/2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d | kernel.org | Patch |
| https://git.kernel.org/stable/c/47fb3c2b4203556308e64354b3e78f2ce221d646 | kernel.org | Patch |
| https://git.kernel.org/stable/c/90fd4513315ca07da99cfd8549d3e553a7160f0d | kernel.org | Patch |
| https://git.kernel.org/stable/c/a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c327fa4fca31415431202e063767a7ae342e19c6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f513f308cc4bdb4530d033431592ffbc29b7fca1 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fc657ac0767c49839b3ef0b08dc0953ca30883f8 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 3.19, < 5.10.259 >= 5.11, < 5.15.210 >= 5.16, < 6.1.176 >= 6.2, < 6.6.143 >= 6.7, < 6.12.94 >= 6.13, < 6.18.36 >= 6.19, < 7.0.13 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 7.1 rc5 7.1 rc6 7.1 rc7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | Initial Analysis | [email protected] |
| Jun 28, 2026 | CVE Modified | kernel.org |
| Jun 25, 2026 | New CVE Received | kernel.org |