CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads

Synopsis

A use-after-free vulnerability exists in the Linux kernel's IPv6-in-IPv4 SIT (Simple Internet Transition) tunnel driver. It is reachable over the network without any authentication and requires no user interaction, meaning a remote attacker can trigger it by sending crafted network packets to an affected host. Successful exploitation gives the attacker full read, write, and availability impact, including the ability to execute arbitrary code or crash the system. A patched-image rebuild at the identified fix commits (including the 5.10.259 stable branch) is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network; an attacker must be able to send packets to the target host's SIT tunnel interface from an external network position.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability; unauthenticated packet delivery to the tunnel is sufficient.

• Victim interactionNot required

  No user or administrator action is required; the kernel processes incoming tunnel packets automatically without any human interaction.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions, memory-layout dependencies, or unusual configuration requirements.

Blast Radius

• A successful attacker reads kernel memory from a freed skb head, exposing sensitive in-flight packet data including inner IPv6 headers, hop limits, and DS fields that may contain session or routing information.
• The attacker can write through the stale pointer, corrupting kernel heap structures and enabling privilege escalation or arbitrary kernel code execution.
• Heap corruption or a null-pointer dereference triggered by the stale pointer can crash the kernel, taking down all workloads on the affected host.
• Any container or VM sharing the affected host kernel is exposed regardless of network namespace isolation, because the vulnerable code runs in shared kernel context.