Executive brief
A vulnerability in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI) could cause network traffic to be incorrectly routed or matched to the wrong tunnel. This occurs because the system fails to properly distinguish between specific and general (wildcard) tunnel configurations during high-traffic scenarios or hash collisions. This could lead to network instability or potential data misrouting in environments using IPv6 IPsec tunnels.
Technical details
A vulnerability exists in the vti6_tnl_lookup() function within net/ipv6/ip6_vti.c. When an exact tunnel match fails, the kernel falls back to searching for wildcard tunnels (matching only local or only remote addresses). Because all tunnel types are stored in the same hash table (ip6n->tnls_r_l), hash collisions can occur. The fallback search loops lacked a check to verify that a candidate tunnel found via hash lookup actually possessed a wildcard address, potentially returning a non-wildcard tunnel that happened to share a hash bucket. This is fixed by adding ipv6_addr_any() checks to the fallback loops.
Affected products
- Linux Linux Kernel 3.19 to 6.13.x
Timeline
- 2026-06-08: other: Patch submitted by Eric Dumazet
- 2026-06-25: disclosed: CVE-2026-53221 published
References
- https://git.kernel.org/stable/c/2abfb19bbb81958714ad1d43ebeb65b30394184b
- https://git.kernel.org/stable/c/2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d
- https://git.kernel.org/stable/c/47fb3c2b4203556308e64354b3e78f2ce221d646
- https://git.kernel.org/stable/c/90fd4513315ca07da99cfd8549d3e553a7160f0d
- https://git.kernel.org/stable/c/a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9
- https://git.kernel.org/stable/c/c327fa4fca31415431202e063767a7ae342e19c6
- https://git.kernel.org/stable/c/f513f308cc4bdb4530d033431592ffbc29b7fca1