CVE-2026-53221

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53221
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53221.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-53221
Downstream
Published
2026-06-25T08:39:23.177Z
Modified
2026-07-17T21:13:59.219735510Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
Details

In the Linux kernel, the following vulnerability has been resolved:

ip6vti: fix incorrect tunnel matching in vti6tnl_lookup()

In vti6tnllookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels:

  • Tunnels matching the packet's local address, with any remote address wildcard remote).

  • Tunnels matching the packet's remote address, with any local address (wildcard local).

However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnlsrl) prone to hash collisions.

The bug is that the fallback search loops in vti6tnllookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53221.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fbe68ee87522f6eaa10f9076c0a7117e1613f2f7
Fixed
c327fa4fca31415431202e063767a7ae342e19c6
Fixed
fc657ac0767c49839b3ef0b08dc0953ca30883f8
Fixed
47fb3c2b4203556308e64354b3e78f2ce221d646
Fixed
f513f308cc4bdb4530d033431592ffbc29b7fca1
Fixed
90fd4513315ca07da99cfd8549d3e553a7160f0d
Fixed
2abfb19bbb81958714ad1d43ebeb65b30394184b
Fixed
2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d
Fixed
a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53221.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.19.0
Fixed
5.10.259
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.210
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.176
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.143
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.94
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.36
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.13

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53221.json"