{"id":"CVE-2026-53228","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.18, < 5.10.259","linux_kernel >= 5.11, < 5.15.210","linux_kernel >= 5.16, < 6.1.176","linux_kernel >= 6.2, < 6.6.143","linux_kernel >= 6.7, < 6.12.94","linux_kernel >= 6.13, < 6.18.36","linux_kernel >= 6.19, < 7.0.13","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.13"],"published":"2026-06-25","updated":"2026-07-02","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53228","references":[{"url":"https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53228.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-53228"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492733"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53228"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53228"},{"url":"https://lore.kernel.org/linux-cve-announce/2026062507-CVE-2026-53228-f3f1@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:64775"},{"url":"https://access.redhat.com/errata/RHSA-2026:68531"},{"url":"https://access.redhat.com/errata/RHSA-2026:68532"}],"tags":["nvd","csaf","vex","red-hat","score-dispute"],"epss":0.00514,"epssPercentile":0.42795,"ingestedAt":"2026-07-03T13:02:28.072Z","cwe":["CWE-825"],"scores":{"nvd":9.8,"vendor":7},"slug":"CVE-2026-53228","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel_handle_offloads().\n\nFor GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().\nWhen the skb header is cloned, skb_header_unclone() can call\npskb_expand_head(), which may move the skb head. The pskb_expand_head()\ncontract requires pointers into the skb header to be reloaded after the\ncall.\n\nIf the later skb_realloc_headroom() branch is not taken, SIT uses the\nstale iph6 pointer to read the inner hop limit and DS field. That can\nread from a freed skb head after the old head's remaining clone is\nreleased.\n\nReload iph6 after the offload helper succeeds and before subsequent\nreads from the inner IPv6 header. Keep the existing reload after\nskb_realloc_headroom(), since that branch can also replace the skb.\n\n## Affected\n\n- `linux_kernel >= 3.18, < 5.10.259`\n- `linux_kernel >= 5.11, < 5.15.210`\n- `linux_kernel >= 5.16, < 6.1.176`\n- `linux_kernel >= 6.2, < 6.6.143`\n- `linux_kernel >= 6.7, < 6.12.94`\n- `linux_kernel >= 6.13, < 6.18.36`\n- `linux_kernel >= 6.19, < 7.0.13`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.13`\n\n## Vendor advisories\n\n- **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53228.json)\n- **RHSA-2026:68531** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68531)\n- **RHSA-2026:68532** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68532)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}