CVE-2026-53221

What it actually does

This Linux kernel flaw affects IPv6 Virtual Tunnel Interface handling in the ip6_vti driver. When vti6_tnl_lookup() fails to find an exact tunnel match, it falls back to wildcard tunnel matching, but the fallback logic did not properly verify that the candidate tunnel actually used a wildcard local or remote address. Because multiple tunnel types are stored in the same hash table and can collide, packets may be associated with the wrong IPv6 VTI tunnel. The practical impact is incorrect tunnel selection and packet routing/processing behavior rather than a typical memory-corruption or code-execution condition.

Why it matters to the business

Organizations using IPv6 VTI/IPsec-style tunnel configurations on affected Linux kernels could experience traffic misrouting, policy bypass, connectivity instability, or incorrect segmentation between tunnel endpoints. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS probability, and has no public exploit maturity reported, so urgency is generally lower than internet-facing remote-code-execution issues; however, infrastructure relying on IPv6 tunnels for secure network boundaries should prioritize remediation because incorrect tunnel matching can undermine routing and security assumptions.

How an attack unfolds

An attacker would need to be in a position to send IPv6 traffic that is processed by a vulnerable host using ip6_vti tunnels, and the host would need a tunnel configuration where hash collisions or overlapping wildcard/exact tunnel entries can influence lookup behavior. The attacker crafts traffic with source and destination IPv6 addresses that fail exact tunnel lookup but cause the fallback search to select a colliding tunnel entry that should not have matched. If successful, the kernel may process the packet under the wrong tunnel context, potentially causing traffic to be routed, accepted, or policy-processed differently than intended. Exploitation depends heavily on local network topology, tunnel configuration, and reachability to the vulnerable tunnel endpoint; there is no indication of broad weaponization at this time.

How to fix it

Upgrade the Linux kernel to a version that includes the upstream fix for ip6_vti tunnel lookup validation. If using a vendor-supported distribution, apply the vendor kernel security update rather than only relying on upstream version numbers, because fixes are commonly backported. Where immediate patching is not possible, reduce exposure by limiting access to IPv6 tunnel endpoints, disabling unused IPv6 VTI functionality, removing unnecessary wildcard tunnel definitions, tightening firewall rules around tunnel endpoints, and reviewing tunnel configurations for overlapping or ambiguous local/remote address combinations.

How to confirm the fix worked

Confirm the running kernel includes the vendor fix for this issue or a backported patch affecting ip6_vti/vti6_tnl_lookup() behavior. Validate package status with distribution tooling such as rpm, dpkg, apt, yum, dnf, zypper, or the vendor advisory database, then confirm the active kernel after reboot with uname -a. For exposure validation, inventory systems with IPv6 VTI tunnel interfaces or loaded ip6_vti functionality, inspect ip -6 tunnel or ip xfrm configurations, and review whether wildcard local or remote tunnel definitions are in use. Functional testing should verify that IPv6 tunnel traffic is matched only to the intended tunnel and that unrelated source/destination combinations are rejected or routed as expected.

Typical attack path

1. Identify a Linux system acting as an IPv6 VTI tunnel endpoint.
2. Determine or infer IPv6 tunnel endpoint addressing and whether wildcard local or remote VTI tunnel definitions are present.
3. Send crafted IPv6 traffic toward the tunnel endpoint using source and destination addresses intended to trigger fallback tunnel lookup behavior.
4. Cause vti6_tnl_lookup() to select an incorrect tunnel entry because wildcard address validation is missing in the fallback path.
5. Leverage the incorrect tunnel association to influence routing, policy handling, traffic isolation, or connectivity behavior.

How to detect it

There are no widely published, CVE-specific exploitation artifacts or threat actor indicators for this issue. Detection should focus on evidence of anomalous IPv6 VTI behavior and exposure. Review kernel logs, system logs, firewall logs, router or VPN gateway telemetry, NetFlow/IPFIX records, and SIEM events for unexpected IPv6 traffic entering or leaving VTI interfaces, packets associated with the wrong tunnel endpoint, route or XFRM policy mismatches, repeated unusual traffic to tunnel endpoint IPv6 addresses, and unexplained connectivity changes involving vti6 or ip6_vti interfaces. On hosts, examine command history and configuration management records for recent unauthorized changes to IPv6 tunnels, wildcard tunnel definitions, XFRM policies, routing tables, or firewall rules. Because successful exploitation may not generate a unique log line, correlate tunnel traffic anomalies with configuration state and kernel version exposure.

What your security team should do

• Inventory Linux systems that act as IPv6 VTI, IPsec, VPN, or network gateway endpoints.
• Prioritize patching on hosts where IPv6 VTI tunnels enforce segmentation, site-to-site connectivity, or sensitive routing policy.
• Apply the relevant vendor kernel update and reboot into the fixed kernel; verify the active kernel version after reboot.
• Review IPv6 tunnel configurations for wildcard local or remote addresses and remove ambiguous or unnecessary tunnel definitions.
• Restrict untrusted network access to IPv6 tunnel endpoints using firewall and router ACLs.
• Monitor for unexpected IPv6 tunnel interface traffic, route changes, policy mismatches, or packets appearing on the wrong tunnel interface.
• Treat exploitation likelihood as currently low because the issue is not KEV-listed, not linked to ransomware, has low EPSS, and has no reported exploit maturity, but do not defer remediation on critical network infrastructure.