{"id":"CVE-2026-53221","summary":"ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()\n\nIn vti6_tnl_lookup(), when an exact match for a tunnel fails,\nthe code falls back to searching for wildcard tunnels:\n\n- Tunnels matching the packet's local address, with any remote address\n  wildcard remote).\n\n- Tunnels matching the packet's remote address, with any local address\n  (wildcard local).\n\nHowever, vti6 stores all these different types of tunnels in the same\nhash table (ip6n-\u003etnls_r_l) prone to hash collisions.\n\nThe bug is that the fallback search loops in vti6_tnl_lookup() were\nmissing checks to ensure that the candidate tunnel actually has\na wildcard address.","modified":"2026-07-17T21:13:59.219735510Z","published":"2026-06-25T08:39:23.177Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53221.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2abfb19bbb81958714ad1d43ebeb65b30394184b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/47fb3c2b4203556308e64354b3e78f2ce221d646"},{"type":"WEB","url":"https://git.kernel.org/stable/c/90fd4513315ca07da99cfd8549d3e553a7160f0d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c327fa4fca31415431202e063767a7ae342e19c6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f513f308cc4bdb4530d033431592ffbc29b7fca1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fc657ac0767c49839b3ef0b08dc0953ca30883f8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53221.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53221"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"fbe68ee87522f6eaa10f9076c0a7117e1613f2f7"},{"fixed":"c327fa4fca31415431202e063767a7ae342e19c6"},{"fixed":"fc657ac0767c49839b3ef0b08dc0953ca30883f8"},{"fixed":"47fb3c2b4203556308e64354b3e78f2ce221d646"},{"fixed":"f513f308cc4bdb4530d033431592ffbc29b7fca1"},{"fixed":"90fd4513315ca07da99cfd8549d3e553a7160f0d"},{"fixed":"2abfb19bbb81958714ad1d43ebeb65b30394184b"},{"fixed":"2fc7bc087cc7085368263d9d37bfe9a0bddd6a2d"},{"fixed":"a5c0359f5cbc51a2e2b114d6041e0f3c73f903e9"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53221.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.36"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53221.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}