Executive brief
A vulnerability was identified in the Linux kernel's IPv6-in-IPv4 (SIT) tunneling component, which is used to transmit IPv6 traffic over older IPv4 networks. Under specific network conditions involving large data packets, the system could attempt to read data from memory that has already been freed. This could lead to system instability, unpredictable network behavior, or potential service disruptions.
Technical details
A use-after-free vulnerability exists in net/ipv6/sit.c within the ipip6_tunnel_xmit() function. The function caches a pointer to the inner IPv6 header (iph6) at entry, but fails to reload it after calling iptunnel_handle_offloads(). For Generic Segmentation Offload (GSO) packets, this call can trigger skb_header_unclone() and pskb_expand_head(), which may reallocate the socket buffer (skb) head and move its memory location. If the skb head is moved, the cached iph6 pointer becomes stale. Subsequent reads of the hop limit and DS fields using this stale pointer result in a use-after-free. The fix involves reloading the iph6 pointer via ipv6_hdr(skb) after the offload handling completes.
Affected products
- Linux Linux Kernel 14909664e4e1 to fddd41445a0537b093e6b3f6232c9933cad1e48b
Timeline
- 2026-06-05: disclosed: Patch submitted by Kyle Zeng
- 2026-06-19: patched: Committed to stable trees by Greg Kroah-Hartman
- 2026-06-25: advisory: CVE-2026-53228 published
References
- https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0
- https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43
- https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193
- https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4
- https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5
- https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c
- https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de