CVE-2026-53228

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SIT (Simple Internet Tunneling) implementation for IPv6. The ipip6 tunnel xmit() function caches the inner IPv6 header pointer at the start of the function and continues to use it after calling iptunnel handle offloads(). For GSO (Generic Segmentation Offload) skbs, iptunnel handle offloads() invokes skb header unclone(), which may call pskb expand head(). This process can move the skb head, rendering existing pointers stale. If the skb realloc headroom() branch is not taken, the system uses a stale iph6 pointer to read the inner hop limit and DS field, potentially leading to a read from a freed skb head after the old head's remaining clone is released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.