{"id":"CVE-2026-23003","aliases":[],"cve":{"records":[{"id":"CVE-2026-23003","source":"Linux","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-01-13T15:37:45.939Z","published":"2026-01-25T14:36:17.491Z","modified":"2026-11-10T12:41:13.915Z"}],"publishers":[{"name":"Linux","role":"CNA","organizationId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","modified":"2026-08-05T12:20:05.561Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-19T18:25:27.372Z"},{"name":"siemens-SADP","role":"ADP","organizationId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","modified":"2026-11-10T12:41:13.915Z"}],"references":[{"url":"https://git.kernel.org/stable/c/f9c5c5b791d3850570796f9e067629474e613796","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/64c71d60a21a9ed0a802483dcd422b5b24eb1abe","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/2f03dafea0a8096a2eb60f551218b360e5bab9a3","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/df5ffde9669314500809bc498ae73d6d3d9519ac","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/b9f915340f25cae1562f18e1eb52deafca328414","tags":[],"source":"Linux"},{"url":"https://git.kernel.org/stable/c/81c734dae203757fb3c9eee6f9896386940776bd","tags":[],"source":"Linux"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","tags":[],"source":"siemens-SADP"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":[],"source":"siemens-SADP"}],"weaknesses":[{"id":"CWE-457","description":"CWE-457 Use of Uninitialized Variable","source":"CISA-ADP"}],"applicability":[{"source":"Linux","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.210","versionEndExcluding":"5.10.249"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.149","versionEndExcluding":"5.15.199"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.77","versionEndExcluding":"6.1.162"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.16","versionEndExcluding":"6.6.122"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.12.67"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.18.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8","versionEndExcluding":"6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.4"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-06-16T20:17:50.477974Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()","titleSource":"Linux","descriptionSource":"Linux","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()\n\nBlamed commit did not take care of VLAN encapsulations\nas spotted by syzbot [1].\n\nUse skb_vlan_inet_prepare() instead of pskb_inet_may_pull().\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n  INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n  IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n  ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n  __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n  ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n  ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438\n  ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500\n  ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590\n  dst_input include/net/dst.h:474 [inline]\n  ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:318 [inline]\n  ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311\n  __netif_receive_skb_one_core net/core/dev.c:6139 [inline]\n  __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252\n  netif_receive_skb_internal net/core/dev.c:6338 [inline]\n  netif_receive_skb+0x57/0x630 net/core/dev.c:6397\n  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n  tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4960 [inline]\n  slab_alloc_node mm/slub.c:5263 [inline]\n  kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315\n  kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586\n  __alloc_skb+0x805/0x1040 net/core/skbuff.c:690\n  alloc_skb include/linux/skbuff.h:1383 [inline]\n  alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712\n  sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995\n  tun_alloc_skb drivers/net/tun.c:1461 [inline]\n  tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]\n  __se_sys_write fs/read_write.c:746 [inline]\n  __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n  x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n  do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025","score":7.5,"severity":"high","published":"2026-01-25T14:36:17.491Z","modified":"2026-11-10T12:41:13.915Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"a9bc32879a08f23cdb80a48c738017e39aea1080","status":"affected","lessThan":"f9c5c5b791d3850570796f9e067629474e613796","versionType":"git"},{"version":"af6b5c50d47ab43e5272ad61935d0ed2e264d3f0","status":"affected","lessThan":"64c71d60a21a9ed0a802483dcd422b5b24eb1abe","versionType":"git"},{"version":"d54e4da98bbfa8c257bdca94c49652d81d18a4d8","status":"affected","lessThan":"9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af","versionType":"git"},{"version":"350a6640fac4b53564ec20aa3f4a0922cb0ba5e6","status":"affected","lessThan":"2f03dafea0a8096a2eb60f551218b360e5bab9a3","versionType":"git"},{"version":"8d975c15c0cd744000ca386247432d57b21f9df0","status":"affected","lessThan":"df5ffde9669314500809bc498ae73d6d3d9519ac","versionType":"git"},{"version":"8d975c15c0cd744000ca386247432d57b21f9df0","status":"affected","lessThan":"b9f915340f25cae1562f18e1eb52deafca328414","versionType":"git"},{"version":"8d975c15c0cd744000ca386247432d57b21f9df0","status":"affected","lessThan":"81c734dae203757fb3c9eee6f9896386940776bd","versionType":"git"},{"version":"c835df3bcc14858ae9b27315dd7de76370b94f3a","status":"affected","versionType":"git"},{"version":"5.10.210","status":"affected","lessThan":"5.10.249","versionType":"semver"},{"version":"5.15.149","status":"affected","lessThan":"5.15.199","versionType":"semver"},{"version":"6.1.77","status":"affected","lessThan":"6.1.162","versionType":"semver"},{"version":"6.6.16","status":"affected","lessThan":"6.6.122","versionType":"semver"},{"version":"6.7.4","status":"affected","lessThan":"6.8","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"6.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.8","versionType":"semver"},{"version":"5.10.249","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.199","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.162","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.122","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.67","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.7","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","cpes":[],"source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","platforms":[],"versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"},{"vendor":"Siemens","name":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"}],"remediation":[],"references":["https://git.kernel.org/stable/c/f9c5c5b791d3850570796f9e067629474e613796","https://git.kernel.org/stable/c/64c71d60a21a9ed0a802483dcd422b5b24eb1abe","https://git.kernel.org/stable/c/9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af","https://git.kernel.org/stable/c/2f03dafea0a8096a2eb60f551218b360e5bab9a3","https://git.kernel.org/stable/c/df5ffde9669314500809bc498ae73d6d3d9519ac","https://git.kernel.org/stable/c/b9f915340f25cae1562f18e1eb52deafca328414","https://git.kernel.org/stable/c/81c734dae203757fb3c9eee6f9896386940776bd","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"sources":[{"name":"CVE","id":"CVE-2026-23003","modified":"2026-11-10T12:41:13.915Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"}],"assessments":[{"source":"Linux","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-10T12:48:02.614Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:35:33.315Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The Linux kernel has a vulnerability in ip6_tunnel where it fails to handle VLAN encapsulations, potentially causing undefined behavior. Affected versions include Linux kernel versions 5.10.210 to 5.10.249, 5.15.149 to 5.15.199, 6.1.77 to 6.1.162, 6.6.16 to 6.6.122, and 6.7.4 to 6.8. The vulnerability is due to the use of uninitialized variables.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T14:46:59.194Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-23003"}]}}