CVE-2026-53228 ipv6: sit: reload inner IPv6 header after GSO offloads
A use-after-free vulnerability in the Linux kernel's IPv6 SIT tunnel allows attackers to execute code or cause a denial of service via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53228?
CVE-2026-53228 is a critical use after free vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sit: reload inner IPv6 header after GSO offloads
ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads().
For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_head(), which may move the skb head. The pskb_expand_head() contract requires pointers into the skb header to be reloaded after the call.
If the later skb_realloc_headroom() branch is not taken, SIT uses the stale iph6 pointer to read the inner hop limit and DS field. That can read from a freed skb head after the old head's remaining clone is released.
Reload iph6 after the offload helper succeeds and before subsequent reads from the inner IPv6 header. Keep the existing reload after skb_realloc_headroom(), since that branch can also replace the skb.
Weakness: CWE-416
Which versions are affected by CVE-2026-53228?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53228?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53228 being exploited?
There is no known exploitation of CVE-2026-53228 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90734, BELL-CVE-2026-53228, DEBIAN-CVE-2026-53228, GHSA-5q2p-7748-g6qp, ROOT-OS-DEBIAN-11-CVE-2026-53228, ROOT-OS-DEBIAN-12-CVE-2026-53228 and 3 more.