Critical 9.8Published Jun 25, 2026

CVE-2026-53221ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

Updated under an hour ago (Oct 27, 2026, 1:30 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any local address (wildcard local). However, vti6 stores all these different types of tunnels in the same hash table (ip6n->tnls_r_l) prone to hash collisions. The bug is that the fallback search loops in vti6_tnl_lookup() were missing checks to ensure that the candidate tunnel actually has a wildcard address.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before c327fa4fca31415431202e063767a7ae342e19c6; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before fc657ac0767c49839b3ef0b08dc0953ca30883f8; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before 47fb3c2b4203556308e64354b3e78f2ce221d646; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before f513f308cc4bdb4530d033431592ffbc29b7fca1; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before 90fd4513315ca07da99cfd8549d3e553a7160f0d; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before 2abfb19bbb81958714ad1d43ebeb65b30394184b; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before 2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d; from fbe68ee87522f6eaa10f9076c0a7117e1613f2f7 before a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.19 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.94; from 6.13 before 6.18.36; from 6.19 before 7.0.13; 7.1; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c327fa4fca31415431202e063767a7ae342e19c6	patch
https://git.kernel.org/stable/c/fc657ac0767c49839b3ef0b08dc0953ca30883f8	patch
https://git.kernel.org/stable/c/47fb3c2b4203556308e64354b3e78f2ce221d646	patch
https://git.kernel.org/stable/c/f513f308cc4bdb4530d033431592ffbc29b7fca1	patch
https://git.kernel.org/stable/c/90fd4513315ca07da99cfd8549d3e553a7160f0d	patch
https://git.kernel.org/stable/c/2abfb19bbb81958714ad1d43ebeb65b30394184b	patch
https://git.kernel.org/stable/c/2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d	patch
https://git.kernel.org/stable/c/a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.