01 Record

CVE-2026-23003

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.48% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 39.0% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-07-14.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-01-25 14:36Z7 MO AGO

Last updated

2026-08-05 12:20Z1 MO AGO

Reserved

2026-01-13

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-908Use of Uninitialized ResourceBase
CWE-457Use of Uninitialized VariableVariant

Data version

5.2

Document digest

c474988743e8819c69faf562207c8c39eefdaece4d4ea37b6c68461f98812e99

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxa9bc32879a08f23cdb80a48c738017e39aea1080 to < f9c5c5b791d3850570796f9e067629474e613796, af6b5c50d47ab43e5272ad61935d0ed2e264d3f0 to < 64c71d60a21a9ed0a802483dcd422b5b24eb1abe, d54e4da98bbfa8c257bdca94c49652d81d18a4d8 to < 9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af, 350a6640fac4b53564ec20aa3f4a0922cb0ba5e6 to < 2f03dafea0a8096a2eb60f551218b360e5bab9a3, 8d975c15c0cd744000ca386247432d57b21f9df0 to < df5ffde9669314500809bc498ae73d6d3d9519ac, 8d975c15c0cd744000ca386247432d57b21f9df0 to < b9f915340f25cae1562f18e1eb52deafca328414, 8d975c15c0cd744000ca386247432d57b21f9df0 to < 81c734dae203757fb3c9eee6f9896386940776bd, c835df3bcc14858ae9b27315dd7de76370b94f3a, 5.10.210 to < 5.10.249, 5.15.149 to < 5.15.199, 6.1.77 to < 6.1.162, 6.6.16 to < 6.6.122, 6.7.4 to < 6.8, 6.8—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/f9c5c5b791d3850570796f9e067629474e613796
git.kernel.orghttps://git.kernel.org/stable/c/64c71d60a21a9ed0a802483dcd422b5b24eb1abe
git.kernel.orghttps://git.kernel.org/stable/c/9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af
git.kernel.orghttps://git.kernel.org/stable/c/2f03dafea0a8096a2eb60f551218b360e5bab9a3
git.kernel.orghttps://git.kernel.org/stable/c/df5ffde9669314500809bc498ae73d6d3d9519ac
git.kernel.orghttps://git.kernel.org/stable/c/b9f915340f25cae1562f18e1eb52deafca328414
git.kernel.orghttps://git.kernel.org/stable/c/81c734dae203757fb3c9eee6f9896386940776bd
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-019113.html

01 Record index

CVE-2026-23003

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2026-23003

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References