Junglewise Threat Intelligence

CVE-2026-23003: Linux Kernel uninitialized memory read in ip6_tunnel

CVE-2026-23003 · Severity: high · CVSS 7.5 · Published 2026-01-25

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's IPv6 tunneling component, which is used to encapsulate and transport network traffic. The issue arises when the system processes specially crafted network packets involving VLAN tags, leading to the use of uninitialized memory. An attacker could exploit this to cause a system crash or denial-of-service, potentially impacting network availability and business operations.

Technical details

A vulnerability in net/ipv6/ip6_tunnel.c exists due to the use of pskb_inet_may_pull() instead of skb_vlan_inet_prepare() in the __ip6_tnl_rcv() function. This flaw causes the kernel to fail to account for VLAN encapsulations when preparing the socket buffer (skb) for decapsulation. As a result, the kernel may attempt to access uninitialized memory during ECN (Explicit Congestion Notification) decapsulation, specifically in __INET_ECN_decapsulate. This is a CWE-908 (Use of Uninitialized Resource) issue that can be triggered by remote network traffic, leading to a kernel panic or denial of service. Patches have been released for multiple stable Linux kernel branches.

Affected products

  • Linux Linux Kernel Affected by commit 8d975c15c0cd; fixed in various stable branches including 6.1, 6.6, 6.12, and 6.13
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-07: patched: Initial patch authored by Eric Dumazet
  • 2026-01-25: advisory: CVE published
  • 2026-07-14: advisory: Siemens product impact added to advisory

References

Related threats