🛡️ CVE-2026-23003 — kernel

🟠 CVSS 7.5 — High ✅ No Known Exploit NVD
7.5
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()

Blamed commit did not take care of VLAN encapsulations

as spotted by syzbot [1].

Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().

[1]

BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]

BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]

BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321

__INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]

INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]

IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321

ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729

__ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860

ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903

gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1

ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438

ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489

NF_HOOK include/linux/netfilter.h:318 [inline]

ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500

ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590

dst_input include/net/dst.h:474 [inline]

ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79

NF_HOOK include/linux/netfilter.h:318 [inline]

ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311

__netif_receive_skb_one_core net/core/dev.c:6139 [inline]

__netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252

netif_receive_skb_internal net/core/dev.c:6338 [inline]

netif_receive_skb+0x57/0x630 net/core/dev.c:6397

tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485

tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953

tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999

new_sync_write fs/read_write.c:593 [inline]

vfs_write+0xbe2/0x15d0 fs/read_write.c:686

ksys_write fs/read_write.c:738 [inline]

__do_sys_write fs/read_write.c:749 [inline]

__se_sys_write fs/read_write.c:746 [inline]

__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746

x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]

do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94

entry_SYSCALL_64_after_hwframe+0x77/0x7f

Uninit was created at:

slab_post_alloc_hook mm/slub.c:4960 [inline]

slab_alloc_node mm/slub.c:5263 [inline]

kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315

kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586

__alloc_skb+0x805/0x1040 net/core/skbuff.c:690

alloc_skb include/linux/skbuff.h:1383 [inline]

alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712

sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995

tun_alloc_skb drivers/net/tun.c:1461 [inline]

tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794

tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999

new_sync_write fs/read_write.c:593 [inline]

vfs_write+0xbe2/0x15d0 fs/read_write.c:686

ksys_write fs/read_write.c:738 [inline]

__do_sys_write fs/read_write.c:749 [inline]

__se_sys_write fs/read_write.c:746 [inline]

__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746

x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]

do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94

entry_SYSCALL_64_after_hwframe+0x77/0x7f

CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

Affected software

CVE-2026-23003 is recorded against 2 packages.

  • kernel (from 6.8.0 up to 6.18.7)
  • linux-kernel

Timeline and source

Published on 25 January 2026 and last revised on 6 August 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.

References

cert-portal.siemens.com (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
git.kernel.org (Web)
github.com (Advisory)
nvd.nist.gov (Advisory)
git.kernel.org (Package)

CVE-2026-23003 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity High
CVSS Score 7.5
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE N/A
Public Exploit ✅ No
Source NVD
Published 2026-01-25
Updated 2026-08-12
Modified 2026-08-06

Affected Packages

Software From version Fixed in
kernel 6.8.0 6.18.7
linux-kernel — —

References

Similar Threats

Site Security Check

Is kernel part of your stack?

CVE-2026-23003 is rated CVSS 7.5 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.