CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads
In the Linux kernel, the following vulnerability has been resolved:
Other sources
ipv6: sit: reload inner IPv6 header after GSO offloads
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.2.6-1Fixed in 7.2.7-1 - Compensating control
In ipip6_tunnel_xmit(), reload the inner IPv6 header pointer (iph6) after iptunnel_handle_offloads() succeeds and before subsequent reads from the inner IPv6 header; retain the existing reload after skb_realloc_headroom().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53228?
The severity of CVE-2026-53228 is critical with a CVSS score of 9.8.
How do I fix CVE-2026-53228?
To fix CVE-2026-53228, users should update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-53228?
CVE-2026-53228 affects the Linux kernel, including Microsoft azl3 kernel versions.
What type of vulnerability is CVE-2026-53228?
CVE-2026-53228 is a critical vulnerability related to improper handling of IPv6 headers in the Linux kernel.
Is CVE-2026-53228 exploitable remotely?
Yes, CVE-2026-53228 is potentially exploitable remotely due to its classification as an attack vector for network access.