CVE Intelligence
Analysis AI-assisted

CVE-2026-53228: Linux kernel SIT tunnel: stale header pointer after GSO offload

CVE-2026-53228 is a critical issue in the Linux kernel SIT tunnel path for IPv6 over IPv4, rated 9.8 by the CNA under CVSS 3.1. The transmit function keeps using an inner IPv6 header pointer after a helper that can move the packet head, which may lead to reads from freed memory. Stable kernel fixes are referenced in the record, and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-53228 concerns the Linux kernel SIT driver, which tunnels IPv6 inside IPv4. According to the record description, the transmit function keeps a pointer to the inner IPv6 header across a call that may reallocate the packet head, so later reads can use a stale address.

Impact

The record states that the stale pointer can be used to read the inner hop limit and DS field, and that this read can touch a freed skb head. The CNA assigned a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Any consequence beyond what the description states is unknown from the available data.

Affected products and versions

The record lists the product Linux Linux Kernel with these ranges:

  • ≥ 3.18 and < 5.10.259
  • ≥ 5.11 and < 5.15.210
  • ≥ 5.16 and < 6.1.176
  • ≥ 6.2 and < 6.6.143
  • ≥ 6.7 and < 6.12.94
  • ≥ 6.13 and < 6.18.36
  • ≥ 6.19 and < 7.0.13
  • version 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4, 7.1-rc5, 7.1-rc6 and 7.1-rc7

The record does not describe distribution packages or backports. Versions outside the listed ranges are not identified as affected in the record, but this should not be read as a confirmed safe state for every vendor build.

Exploitation status

The KEV catalogue entry in the record is not listed. No confirmed active exploitation appears in the sources consulted. The EPSS score is not available in the record.

Remediation and mitigation

  • Update the kernel to a stable release that includes the upstream fix for your version branch. The record links eight stable commits.
  • Check whether your distribution has shipped a backported fix, since the record does not cover distribution packages.
  • If the SIT tunnel driver is not needed on a system, consider disabling or not loading it, following your distribution guidance.
  • Reboot after installing a kernel update so the fixed code is running.

Detection guidance

  • Inventory Linux hosts and record kernel versions against the ranges above.
  • Identify systems where the sit module is loaded or where IPv6-over-IPv4 tunnels are configured.
  • Review kernel logs for memory-related warnings on hosts that use these tunnels, keeping in mind that the record does not describe specific log signatures.

Limitations of the available information

  • The record has no title, CWE, SSVC data or EPSS score.
  • The sources consulted are the NVD and CVE Program pages and the kernel.org stable commits, not a full vendor advisory.
  • The record does not provide a proof of concept, exploitation details or the impact on specific distributions.

Frequently asked questions

Is CVE-2026-53228 being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. Keep monitoring official sources.

What should administrators do first?

Identify Linux hosts in the affected ranges and apply a stable kernel update that includes the upstream fix for your branch. Check whether your distribution has published a backported fix.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.