CVE-2026-53221: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()

Synopsis

A tunnel-matching logic flaw in the Linux kernel's ip6_vti (IPv6 Virtual Tunnel Interface) driver allows an unauthenticated remote attacker to exploit incorrect wildcard address checks in vti6_tnl_lookup(). The vulnerability is reachable over the network with no authentication required and no user interaction needed. Successful exploitation gives an attacker full read, write, and crash capability against the affected system. Patched-image rebuilds at the fix versions are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability; PR:N confirms a fully unauthenticated attack path.

• Victim interactionNot required

  The attack is entirely attacker-driven and requires no action from any user on the target system; UI:N applies.

• Attack complexityDetail

  Exploitation is reliable and imposes no special environmental conditions or timing constraints; AC:L indicates a condition-free attack.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing credentials, cryptographic material, and other sensitive in-memory data.
• A successful attacker writes to kernel memory, allowing modification of network routing state, process credentials, or other persisted kernel structures.
• A successful attacker crashes the affected system, causing a full denial of service to all workloads running on the host.
• Because all three impact dimensions are rated High, a single exploit can chain disclosure, tampering, and disruption in one attack.