CVE-2026-53221

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()<br /> <br /> In vti6_tnl_lookup(), when an exact match for a tunnel fails,<br /> the code falls back to searching for wildcard tunnels:<br /> <br /> - Tunnels matching the packet&amp;#39;s local address, with any remote address<br /> wildcard remote).<br /> <br /> - Tunnels matching the packet&amp;#39;s remote address, with any local address<br /> (wildcard local).<br /> <br /> However, vti6 stores all these different types of tunnels in the same<br /> hash table (ip6n-&gt;tnls_r_l) prone to hash collisions.<br /> <br /> The bug is that the fallback search loops in vti6_tnl_lookup() were<br /> missing checks to ensure that the candidate tunnel actually has<br /> a wildcard address.