Security readout for executives and security teams
Plain-English summary
A Linux IPv6 tunnelling flaw can process VLAN-encapsulated traffic using uninitialized data. The supplied CVSS assessment rates it as remotely reachable without authentication and capable of causing availability loss, but not data theft or modification. Systems handling IPv6 tunnel or GRE traffic deserve priority review.
Executive priority
Prioritize accelerated remediation on internet-facing gateways, virtual networking hosts, and appliances using IPv6 tunnels or GRE. Normal patch cadence may be reasonable where teams verify the affected traffic path is absent. The high CVSS score supports urgency, while the lack of documented exploitation tempers emergency-response escalation.
Technical view
The __ip6_tnl_rcv() path used pskb_inet_may_pull() without adequately preparing VLAN encapsulations. This allowed uninitialized data to reach IPv6 ECN decapsulation logic. The kernel fix replaces that call with skb_vlan_inet_prepare(). The supplied syzbot trace exercised the path through a TUN device and IPv6 GRE processing.
Likely exposure
Exposure is most plausible on Linux systems processing IPv6 tunnel or GRE traffic with VLAN encapsulation, including networking hosts and embedded appliances. The bundle identifies affected kernel versions but lacks sufficient range semantics for reliable package-level conclusions; distribution and product advisories must determine applicability.
Exploitation context
The CVSS vector reports network access, low complexity, no privileges, no user interaction, and availability-only impact. However, the documented reproduction used syzbot, a TUN device, and a UID 0 process. The CVE is not listed as KEV, and the bundle provides no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The report demonstrates an uninitialized-value condition in IPv6 ECN decapsulation after VLAN-related preparation was omitted. The available evidence does not establish the precise failure mode, reproducibility by an unauthenticated remote actor, or affected distribution packages. Treat the CVSS remote availability characterization as supplied assessment, not confirmed field exploitation.
Mitigation direction
- Inventory Linux kernels on hosts and appliances that process IPv6 tunnel, GRE, or VLAN traffic.
- Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
- If upgrading is delayed, follow vendor guidance for limiting unnecessary IPv6 tunnel and GRE exposure.
- Review the Siemens advisory for affected Siemens products and product-specific remediation.
Validation and detection
- Record running kernel and package versions, then compare them with distribution or product advisories.
- Confirm the updated kernel contains the applicable fix using skb_vlan_inet_prepare() in __ip6_tnl_rcv().
- Test required IPv6 tunnel, GRE, and VLAN functions after maintenance.
- Review kernel diagnostics for matching uninitialized-value reports in IPv6 ECN decapsulation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23003 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f9c5c5b791d3850570796f9e067629474e613796CVE reference, Linux
- https://git.kernel.org/stable/c/64c71d60a21a9ed0a802483dcd422b5b24eb1abeCVE reference, Linux
- https://git.kernel.org/stable/c/9e1c8c2a33d0a7b1f637b5d0602fe56ed10166afCVE reference, Linux
- https://git.kernel.org/stable/c/2f03dafea0a8096a2eb60f551218b360e5bab9a3CVE reference, Linux
- https://git.kernel.org/stable/c/df5ffde9669314500809bc498ae73d6d3d9519acCVE reference, Linux
- https://git.kernel.org/stable/c/b9f915340f25cae1562f18e1eb52deafca328414CVE reference, Linux
- https://git.kernel.org/stable/c/81c734dae203757fb3c9eee6f9896386940776bdCVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.