Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-23003

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

Products / packages Linux · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) · 3 more

Published

Share

Severity and exploitation

Not in CISA KEV

KEV coverage does not rule out exploitation.

KEV checked 15/11/2026, 01:40:32 UTC
Linux · CVSS:3.1 · 7.5
Assessment vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity

high7.5

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

The Linux kernel has a vulnerability in ip6_tunnel where it fails to handle VLAN encapsulations, potentially causing undefined behavior. Affected versions include Linux kernel versions 5.10.210 to 5.10.249, 5.15.149 to 5.15.199, 6.1.77 to 6.1.162, 6.6.16 to 6.6.122, and 6.7.4 to 6.8. The vulnerability is due to the use of uninitialized variables.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

13 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

a9bc32879a08f23cdb80a48c738017e39aea1080 → before f9c5c5b791d3850570796f9e067629474e613796

git versions

af6b5c50d47ab43e5272ad61935d0ed2e264d3f0 → before 64c71d60a21a9ed0a802483dcd422b5b24eb1abe

git versions

d54e4da98bbfa8c257bdca94c49652d81d18a4d8 → before 9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af

git versions

350a6640fac4b53564ec20aa3f4a0922cb0ba5e6 → before 2f03dafea0a8096a2eb60f551218b360e5bab9a3

git versions

8d975c15c0cd744000ca386247432d57b21f9df0 → before df5ffde9669314500809bc498ae73d6d3d9519ac

git versions

8d975c15c0cd744000ca386247432d57b21f9df0 → before b9f915340f25cae1562f18e1eb52deafca328414

git versions

8d975c15c0cd744000ca386247432d57b21f9df0 → before 81c734dae203757fb3c9eee6f9896386940776bd

git versions

c835df3bcc14858ae9b27315dd7de76370b94f3a

git versions

5.10.210 → before 5.10.249

semver versions

5.15.149 → before 5.15.199

semver versions

6.1.77 → before 6.1.162

semver versions

6.6.16 → before 6.6.122

semver versions

6.7.4 → before 6.8

semver versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

9 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

6.8

unaffected

0 → before 6.8

semver versions

5.10.249 → through 5.10.*

semver versions

5.15.199 → through 5.15.*

semver versions

6.1.162 → through 6.1.*

semver versions

6.6.122 → through 6.6.*

semver versions

6.12.67 → through 6.12.*

semver versions

6.18.7 → through 6.18.*

semver versions

6.19 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.6 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.7 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.6 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.7 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.6 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.7 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.6 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.7 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.6 → before *

custom versions

unaffected

unknown

Other versions: unknown

Siemens · siemens-SADP

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)

1 range
siemens-SADP version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

V3.1.7 → before *

custom versions

unaffected

unknown

Other versions: unknown

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1].

Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().

[1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at: slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

References

9 sources
git.kernel.org/stable/c/f9c5c5b791d3850570796f9e067629474e613796
Source referenceLinux
git.kernel.org/stable/c/64c71d60a21a9ed0a802483dcd422b5b24eb1abe
Source referenceLinux
git.kernel.org/stable/c/9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af
Source referenceLinux
git.kernel.org/stable/c/2f03dafea0a8096a2eb60f551218b360e5bab9a3
Source referenceLinux
git.kernel.org/stable/c/df5ffde9669314500809bc498ae73d6d3d9519ac
Source referenceLinux
git.kernel.org/stable/c/b9f915340f25cae1562f18e1eb52deafca328414
Source referenceLinux
View 3 more references
git.kernel.org/stable/c/81c734dae203757fb3c9eee6f9896386940776bd
Source referenceLinux
cert-portal.siemens.com/productcert/html/ssa-019113.html
Source referencesiemens-SADP
cert-portal.siemens.com/productcert/html/ssa-457936.html
Source referencesiemens-SADP

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification
Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-23003

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-457 ↗

CWE-457 Use of Uninitialized Variable

CISA-ADP

Related →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.10.210

Before: 5.10.249

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.15.149

Before: 5.15.199

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.1.77

Before: 6.1.162

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.6.16

Before: 6.6.122

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.8

Before: 6.12.67

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.8

Before: 6.18.7

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.8

Before: 6.19

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 6.7.4

Applicability preview
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.10.210",
            "versionEndExcluding": "5.10.249"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.15.149",
            "versionEndExcluding": "5.15.199"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.1.77",
            "versionEndExcluding": "6.1.162"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.6.16",
            "versionEndExcluding": "6.6.122"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.8",
            "versionEndExcluding": "6.12.67"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.8",
            "versionEndExcluding": "6.18.7"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.8",
            "versionEndExcluding": "6.19"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "6.7.4"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 3
Linux

Assigning organization

2026-08-05
CISA-ADP

Additional data publisher

2026-10-19
siemens-SADP

Additional data publisher

2026-11-10

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.