CVE Intelligence
Analysis AI-assisted

CVE-2026-53221: Linux kernel ip6_vti tunnel lookup mismatch

CVE-2026-53221 is a flaw in the Linux kernel ip6_vti driver, where the fallback search in vti6_tnl_lookup() does not confirm that a candidate tunnel really uses a wildcard address. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record lists stable-branch fix commits. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-53221 concerns the ip6_vti driver in the Linux kernel. When an exact tunnel match fails in vti6_tnl_lookup(), the code searches for wildcard tunnels, but the fallback loops did not check that the candidate tunnel actually has a wildcard address. Tunnels of different types share one hash table, so collisions can cause a tunnel of the wrong type to be considered a match.

Impact

  • The CNA assigns a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network reachability, no privileges or user interaction, and high impact on confidentiality, integrity and availability.
  • The record does not describe the concrete consequences of the mismatch. The practical impact depends on whether a system uses ip6_vti tunnels.

Affected products and versions

The record lists the Linux Linux Kernel product with these ranges:

  • 3.19 up to but not including 5.10.259
  • 5.11 up to but not including 5.15.210
  • 5.16 up to but not including 6.1.176
  • 6.2 up to but not including 6.6.143
  • 6.7 up to but not including 6.12.94
  • 6.13 up to but not including 6.18.36
  • 6.19 up to but not including 7.0.13
  • 7.1-rc1 through 7.1-rc7

The record does not give a fixed version for the 7.1 development line.

Exploitation status

The CVE is not listed in CISA KEV in the record. No confirmed exploitation appears in the sources consulted. This is not evidence that exploitation does not occur.

Remediation and mitigation

  • Identify systems running the affected kernel ranges, including distribution kernels that backport stable fixes.
  • Apply the vendor or distribution kernel update that includes the upstream fix. The upstream commits are listed in the NVD entry.
  • Where ip6_vti tunnels are not required, consider removing or disabling them under your change control process.

Detection guidance

  • Inventory kernel versions and check whether the ip6_vti module or VTI6 interfaces are in use.
  • Review tunnel configurations for unexpected local or remote endpoint definitions that could interact with wildcard matching.
  • Monitor for unexpected traffic routed through VTI6 interfaces. This is a high-level approach and does not replace vendor guidance.

Limitations of the available information

  • No CWE is assigned in the record.
  • EPSS and SSVC data are not available.
  • The record does not describe a proof of concept or real-world incidents.
  • The fixed version for the 7.1 line is not stated.
  • Distribution-specific fixed versions are not included in the record.

Frequently asked questions

What is the root cause of CVE-2026-53221?

The fallback search in vti6_tnl_lookup() did not verify that a candidate tunnel actually had a wildcard address, while different tunnel types share one hash table where collisions can occur.

Is CVE-2026-53221 known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. This does not rule out exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.