CVE-2026-53228

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: sit: reload inner IPv6 header after GSO offloads<br /> <br /> ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function<br /> entry and continues using it after iptunnel_handle_offloads().<br /> <br /> For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().<br /> When the skb header is cloned, skb_header_unclone() can call<br /> pskb_expand_head(), which may move the skb head. The pskb_expand_head()<br /> contract requires pointers into the skb header to be reloaded after the<br /> call.<br /> <br /> If the later skb_realloc_headroom() branch is not taken, SIT uses the<br /> stale iph6 pointer to read the inner hop limit and DS field. That can<br /> read from a freed skb head after the old head&amp;#39;s remaining clone is<br /> released.<br /> <br /> Reload iph6 after the offload helper succeeds and before subsequent<br /> reads from the inner IPv6 header. Keep the existing reload after<br /> skb_realloc_headroom(), since that branch can also replace the skb.