CVE-2026-53221

A flaw was found in the Linux kernel, specifically within the ip6_vti component responsible for managing IPv6 tunnels. This vulnerability arises from an error in the vti6_tnl_lookup() function, which incorrectly matches network tunnels by failing to properly verify wildcard addresses during fallback searches. This can lead to network traffic being misdirected or dropped, potentially disrupting network services. The underlying cause is a lack of checks to confirm that a candidate tunnel indeed has a wildcard address.

ip6_vti can select the wrong VTI6 tunnel because fallback lookup for wildcard endpoints did not verify that the candidate tunnel actually has a wildcard remote or wildcard local address. A remote packet can reach this lookup path when IPv6 VTI or IPsec tunnel endpoints are exposed, but reliable impact depends on the target tunnel configuration and on hash collision conditions. For the CVSS the PR:N is used because the attacker does not need local code execution on the victim when the affected tunnel endpoint is reachable over the network. AC:H is used because exploitation depends on non trivial tunnel layout, wildcard fallback behavior, and hash bucket collision. Impact is mainly a network policy or routing integrity issue, with possible limited confidentiality impact in multi tunnel deployments, but there is no evidence of kernel memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.