CVE-2026-53228 Overview
CVE-2026-53228 is a use-after-free vulnerability in the Linux kernel's IPv6 Simple Internet Transition (SIT) tunnel transmit path. The flaw resides in ipip6_tunnel_xmit(), which caches an inner IPv6 header pointer before calling iptunnel_handle_offloads(). For Generic Segmentation Offload (GSO) skbs with cloned headers, iptunnel_handle_offloads() may invoke pskb_expand_head(), relocating the skb head. The cached iph6 pointer becomes stale and can reference memory from a freed skb head once the prior clone is released.
Critical Impact
Local attackers leveraging IPv6-in-IPv4 tunnel traffic can trigger reads from freed kernel memory, potentially leading to information disclosure or kernel memory corruption.
Affected Products
- Linux kernel — ipv6/sit tunnel driver
- Multiple stable kernel branches receiving the backport (per upstream stable tree commits)
- Systems with IPv6-in-IPv4 (SIT) tunneling enabled and GSO offloads active
Discovery Timeline
- 2026-06-25 - CVE-2026-53228 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53228
Vulnerability Analysis
The SIT driver implements IPv6 packets encapsulated in IPv4 for transition tunneling. Inside ipip6_tunnel_xmit(), the kernel reads the inner IPv6 header via a pointer stored at function entry as iph6. This pointer is later dereferenced to extract the inner hop limit and Differentiated Services (DS) field used to construct the outer IPv4 header.
Between caching the pointer and using it, the function calls iptunnel_handle_offloads() to prepare GSO-segmented socket buffers. When the skb header is cloned, this helper invokes skb_header_unclone(), which may call pskb_expand_head() to reallocate the linear data area. The kernel's pskb_expand_head() contract requires callers to reload any pointers into the skb header after the call, because the underlying buffer can move.
If execution does not subsequently enter the skb_realloc_headroom() branch (which already reloads iph6), the function continues with a dangling pointer. Reading the stale iph6 accesses freed memory once the remaining clone holding the old head is released, producing a classic use-after-free condition [CWE-416] in the kernel network stack.
Root Cause
The root cause is a missed pointer reload after a buffer-relocating operation. iptunnel_handle_offloads() can move the skb head, but the SIT transmit path did not reload iph6 on the non-realloc-headroom path before dereferencing inner header fields.
Attack Vector
Exploitation requires the ability to send traffic through a configured SIT tunnel under conditions that produce cloned, GSO-eligible skbs. A local user or a co-resident workload with network transmit capability over the SIT interface can craft conditions that exercise the vulnerable path, triggering reads from freed memory. The vulnerability does not require remote authentication but does depend on the system having SIT tunneling enabled.
No verified public exploit code is available for this issue. See the upstream patches referenced under Linux Kernel stable commits for technical details of the fix.
Detection Methods for CVE-2026-53228
Indicators of Compromise
- Kernel oops or KASAN: use-after-free reports referencing ipip6_tunnel_xmit in the call stack
- Unexpected kernel panics or general protection fault events correlated with high-throughput SIT tunnel traffic
- Anomalous network errors on sit0 or other SIT interfaces during GSO-heavy workloads
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) on test or pre-production kernels to surface use-after-free reads in the SIT transmit path
- Collect and parse dmesg and journalctl -k output for stack traces containing ipip6_tunnel_xmit, iptunnel_handle_offloads, or pskb_expand_head
- Inventory hosts with SIT tunnel devices configured (ip -d link show type sit) to scope exposure
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on BUG:, KASAN, and Oops patterns referencing networking modules
- Track running kernel versions across the fleet and flag hosts not running a patched build from your distribution
- Monitor for unexpected creation of SIT tunnel interfaces, which expand the attack surface for this class of bug
How to Mitigate CVE-2026-53228
Immediate Actions Required
- Apply the patched kernel from your Linux distribution as soon as builds incorporating the upstream fix are available
- Identify all systems with SIT tunnels configured and prioritize them for patching
- If patching is delayed, evaluate whether SIT tunneling is operationally required and disable it where it is not
Patch Information
The fix reloads the iph6 pointer after iptunnel_handle_offloads() succeeds and before any subsequent reads from the inner IPv6 header, while preserving the existing reload after skb_realloc_headroom(). The change has been merged across multiple stable branches. Reference commits include 0bfa7bba1f41, 1132e5edc286, 2fa49b2715e1, 59f80c919713, 9c67b44edb35, cb658c2f5f79, f0e42f0c4337, and fddd41445a05.
Workarounds
- Unload the sit kernel module on hosts that do not require IPv6-in-IPv4 tunneling: modprobe -r sit
- Blacklist the sit module via /etc/modprobe.d/ to prevent automatic loading on reboot
- Where SIT is required, restrict which users and workloads can transmit through the tunnel interface using network namespaces and capability restrictions
# Configuration example
# Identify SIT interfaces present on the system
ip -d link show type sit
# If SIT tunneling is not required, prevent the module from loading
echo 'install sit /bin/true' | sudo tee /etc/modprobe.d/disable-sit.conf
sudo modprobe -r sit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
