CVE-2026-23003: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23003 Overview

CVE-2026-23003 is an uninitialized memory use vulnerability [CWE-908] in the Linux kernel's IPv6 tunnel implementation. The flaw resides in the __ip6_tnl_rcv() function within net/ipv6/ip6_tunnel.c, which failed to handle VLAN-encapsulated packets correctly. A prior commit introduced the regression by relying on pskb_inet_may_pull() rather than a VLAN-aware variant. The syzkaller fuzzer (syzbot) detected the issue through KMSAN reports showing uninitialized values reaching IP6_ECN_decapsulate(). Local attackers with the ability to inject crafted packets via a TUN device can trigger kernel memory corruption paths leading to denial of service.

Critical Impact
A local user can supply malformed VLAN-encapsulated IPv6 tunnel traffic through a TUN interface to read uninitialized kernel memory and crash the kernel, resulting in a high-availability impact on affected hosts.

Affected Products

Linux Kernel (multiple stable branches, per the seven backport commits referenced by upstream)
Linux Kernel 6.8 release stream
Linux Kernel 6.19 release candidates (rc1 through rc8)

Discovery Timeline

2026-01-25 - CVE-2026-23003 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-23003

Vulnerability Analysis

The vulnerability occurs in the IPv6 tunnel receive path. When a packet arrives through an IPv6 tunnel and contains a VLAN encapsulation header, __ip6_tnl_rcv() invokes pskb_inet_may_pull() to validate the inner header. This helper does not account for the additional VLAN tag bytes between the outer transport header and the inner IP header. As a result, the inner IPv6 header may not be fully present in the linear skb buffer when subsequent decapsulation routines read it.

The downstream call chain reaches ip6ip6_dscp_ecn_decapsulate() and then IP6_ECN_decapsulate(), which dereferences fields from the inner header. KMSAN flagged these reads as uninitialized-value bugs because the bytes had never been pulled into the linear region of the socket buffer. The trigger path observed by syzbot originates in tun_chr_write_iter() via writes to /dev/net/tun, traversing netif_receive_skb() and gre_rcv() before reaching the vulnerable function.

Root Cause

The blamed commit replaced an earlier validation routine with pskb_inet_may_pull() without considering encapsulated VLAN frames. The fix replaces that call with skb_vlan_inet_prepare(), which correctly accounts for VLAN tag length before pulling the inner header. Without this adjustment, the kernel processes ECN bits and DSCP fields read from memory that the sender never populated, producing undefined behavior classified under [CWE-908] Use of Uninitialized Resource.

Attack Vector

Exploitation requires local access and the ability to write packets to a TUN device, which typically requires CAP_NET_ADMIN or an unprivileged user namespace permitting TUN creation. The attacker constructs an IPv6 packet carrying a GRE or ip6ip6 payload with a VLAN tag preceding a truncated inner IPv6 header. When the kernel processes the frame, the uninitialized read triggers a KMSAN-detectable fault or potential kernel panic, denying service to the host. The vulnerability does not provide a direct path to code execution or information disclosure to userland, but it does crash kernel processing for tunnel traffic.

The vulnerability manifests in the IPv6 tunnel receive function. See the upstream patch commit for the corrected handling using skb_vlan_inet_prepare().

Detection Methods for CVE-2026-23003

Indicators of Compromise

Kernel panic or BUG: KMSAN: uninit-value messages referencing __ip6_tnl_rcv, IP6_ECN_decapsulate, or ip6ip6_dscp_ecn_decapsulate in dmesg and /var/log/kern.log.
Unexpected process termination of services bound to IPv6 tunnel interfaces (ip6tnl, ip6gre).
Unusual creation of TUN devices by non-administrative users or containers with CAP_NET_ADMIN.

Detection Strategies

Monitor kernel logs for crash signatures involving gre_rcv, ip6_protocol_deliver_rcu, and __ip6_tnl_rcv stack frames.
Audit kernel versions across the fleet against the patched commits listed in the upstream advisory and flag hosts running unpatched 6.8 or 6.19-rc builds.
Inspect auditd logs for ioctl calls on /dev/net/tun from unprivileged contexts.

Monitoring Recommendations

Enable persistent kernel crash collection (kdump, pstore) so post-panic stack traces survive reboot for forensic review.
Track creation events for ip6tnl, ip6gre, and TUN interfaces through netlink auditing rules.
Centralize kernel ring buffer telemetry into a SIEM and alert on KMSAN or BUG: strings tied to tunnel functions.

How to Mitigate CVE-2026-23003

Immediate Actions Required

Apply the upstream kernel patches that switch __ip6_tnl_rcv() to skb_vlan_inet_prepare() from the stable trees referenced in the vendor advisory.
Restrict TUN/TAP device creation to trusted administrators by tightening CAP_NET_ADMIN grants and disabling user-namespace TUN access where feasible.
Inventory hosts running Linux 6.8 or 6.19 release candidates and prioritize rebuild or vendor kernel updates.

Patch Information

The Linux kernel maintainers released fixes across multiple stable branches. Review the corresponding commits and apply the version appropriate to your kernel branch:

Workarounds

Unload or blacklist the ip6_tunnel and ip6_gre modules on systems that do not require IPv6 tunneling.
Block untrusted users from creating TUN devices by removing CAP_NET_ADMIN from container profiles and unprivileged user namespaces.
Drop unexpected GRE and ip6ip6 traffic at the host firewall (nftables, iptables) where tunneling is not part of the workload.

bash

# Configuration example: disable ip6 tunnel modules on hosts that do not need them
echo 'install ip6_tunnel /bin/true' | sudo tee /etc/modprobe.d/disable-ip6tnl.conf
echo 'install ip6_gre /bin/true'    | sudo tee -a /etc/modprobe.d/disable-ip6tnl.conf
sudo rmmod ip6_gre ip6_tunnel 2>/dev/null || true

# Restrict TUN device access to a trusted group
sudo chgrp netadmin /dev/net/tun
sudo chmod 0660 /dev/net/tun