CVE-2026-23003: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23003 is a use of uninitialized resource (CWE-908) vulnerability in the Linux kernel's IPv6 tunneling subsystem. The __ip6_tnl_rcv() function in net/ipv6/ip6_tunnel.c fails to use skb_vlan_inet_prepare() when processing VLAN-encapsulated packets, instead using pskb_inet_may_pull(), which does not account for VLAN headers. This causes uninitialized memory values to be read during ECN (Explicit Congestion Notification) decapsulation. Affected kernel versions include 5.10.210–5.10.249, 5.15.149–5.15.199, 6.1.77–6.1.162, 6.6.16–6.6.122, 6.7.4–6.8, 6.8.1–6.12.67, 6.13–6.18.7, and 6.19 release candidates. It was disclosed on January 25, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-908 (Use of Uninitialized Resource). The vulnerability was introduced when a prior commit updated __ip6_tnl_rcv() but neglected to handle VLAN-encapsulated packets correctly — pskb_inet_may_pull() does not pull through VLAN headers, leaving the inner IP header fields uninitialized when the kernel subsequently attempts ECN decapsulation via IP6_ECN_decapsulate() and related functions. An attacker with local access and low privileges can craft VLAN-encapsulated IPv6 packets and inject them through a TUN/TAP interface (as demonstrated by the syzbot trace showing tun_get_user → tun_chr_write_iter in the call stack), triggering the uninitialized read in kernel space. The bug was originally identified by syzbot, Google's automated kernel fuzzer (Red Hat Bugzilla).

Exploitation can result in denial of service via kernel panic or crash, information disclosure through leaked uninitialized kernel memory values, or potentially privilege escalation, though the latter is considered less likely. The vulnerability affects systems using IPv6 tunneling features (ip6_tunnel, ip6gre) and is triggered during processing of IPv6 tunnel and GRE traffic with VLAN encapsulation. Confidentiality and availability are the primary concerns, with no integrity impact identified (Red Hat Advisory, Red Hat Bugzilla).

Apply the upstream kernel patches available via stable kernel trees for the affected version ranges. Fixed versions include 5.10.249+, 5.15.199+, 6.1.162+, 6.6.122+, 6.12.67+, and 6.18.7+, with patches committed to the stable kernel repository (git.kernel.org). Distribution-specific updates are available from Red Hat (Bugzilla #2432681), Ubuntu (USN-8162-1, USN-8180-x series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-x, USN-8289-x, USN-8296-x, USN-8297-1), SUSE (SUSE-2026-0962-1), Oracle Linux, and Amazon Linux 2. As a workaround where patching is not immediately possible, restrict local access to tunnel interfaces and TUN/TAP devices to trusted users, and consider disabling IPv6 tunneling features (ip6_tunnel, ip6gre kernel modules) if not required (Red Hat Bugzilla).