GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23276 (GCVE-0-2026-23276)

Vulnerability from cvelistv5 – Published: 2026-03-20 08:08 – Updated: 2026-05-23 16:04
VLAI
Title
net: add xmit recursion limit to tunnel xmit functions
Summary
In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow. The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not sufficient because tunnel recursion involves route lookups and full IP output, consuming much more stack per level. Use a lower limit of 4 (IP_TUNNEL_RECURSION_LIMIT) to prevent overflow. Add recursion detection using dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.). Move dev_xmit_recursion helpers from net/core/dev.h to public header include/linux/netdevice.h so they can be used by tunnel code. BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160 Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11 Workqueue: mld mld_ifc_work Call Trace: <TASK> __build_flow_key.constprop.0 (net/ipv4/route.c:515) ip_rt_update_pmtu (net/ipv4/route.c:1073) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) ip_finish_output2 (net/ipv4/ip_output.c:237) ip_output (net/ipv4/ip_output.c:438) iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86) ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) gre_tap_xmit (net/ipv4/ip_gre.c:779) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279) bond_start_xmit (drivers/net/bonding/bond_main.c:5530) dev_hard_start_xmit (net/core/dev.c:3887) __dev_queue_xmit (net/core/dev.c:4841) mld_sendpack mld_ifc_work process_one_work worker_thread </TASK>
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 745e20f1b626b1be4b100af5d4bf7b3439392f8f , < 834c4f645726a25fd71ea50cdfb5c135f8f95d85 (git)
Affected: 745e20f1b626b1be4b100af5d4bf7b3439392f8f , < 8a57deeb256069f262957d8012418559ff66c385 (git)
Affected: 745e20f1b626b1be4b100af5d4bf7b3439392f8f , < b56b8d19bd05e2a8338385c770bc2b60590bc81e (git)
Affected: 745e20f1b626b1be4b100af5d4bf7b3439392f8f , < 6f1a9140ecda3baba3d945b9a6155af4268aafc4 (git)
Affected: 3f266b04185de51d8e6446eb1fccec3b5e7ce575 (git)
Affected: 2.6.35.9 , < 2.6.36 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.37
Unaffected: 0 , < 2.6.37 (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "include/net/ip6_tunnel.h",
            "include/net/ip_tunnels.h",
            "net/core/dev.h",
            "net/ipv4/ip_tunnel_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "834c4f645726a25fd71ea50cdfb5c135f8f95d85",
              "status": "affected",
              "version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
              "versionType": "git"
            },
            {
              "lessThan": "8a57deeb256069f262957d8012418559ff66c385",
              "status": "affected",
              "version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
              "versionType": "git"
            },
            {
              "lessThan": "b56b8d19bd05e2a8338385c770bc2b60590bc81e",
              "status": "affected",
              "version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
              "versionType": "git"
            },
            {
              "lessThan": "6f1a9140ecda3baba3d945b9a6155af4268aafc4",
              "status": "affected",
              "version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3f266b04185de51d8e6446eb1fccec3b5e7ce575",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.36",
              "status": "affected",
              "version": "2.6.35.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h",
            "include/net/ip6_tunnel.h",
            "include/net/ip_tunnels.h",
            "net/core/dev.h",
            "net/ipv4/ip_tunnel_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.37"
            },
            {
              "lessThan": "2.6.37",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.37",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.35.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add xmit recursion limit to tunnel xmit functions\n\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\nrecursion limit. When a bond device in broadcast mode has GRE tap\ninterfaces as slaves, and those GRE tunnels route back through the\nbond, multicast/broadcast traffic triggers infinite recursion between\nbond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing\nkernel stack overflow.\n\nThe existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not\nsufficient because tunnel recursion involves route lookups and full IP\noutput, consuming much more stack per level. Use a lower limit of 4\n(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.\n\nAdd recursion detection using dev_xmit_recursion helpers directly in\niptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel\npaths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).\n\nMove dev_xmit_recursion helpers from net/core/dev.h to public header\ninclude/linux/netdevice.h so they can be used by tunnel code.\n\n BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160\n Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11\n Workqueue: mld mld_ifc_work\n Call Trace:\n  \u003cTASK\u003e\n  __build_flow_key.constprop.0 (net/ipv4/route.c:515)\n  ip_rt_update_pmtu (net/ipv4/route.c:1073)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  ip_output (net/ipv4/ip_output.c:438)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  ip_output (net/ipv4/ip_output.c:438)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  mld_sendpack\n  mld_ifc_work\n  process_one_work\n  worker_thread\n  \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:04:28.110Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385"
        },
        {
          "url": "https://git.kernel.org/stable/c/b56b8d19bd05e2a8338385c770bc2b60590bc81e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"
        }
      ],
      "title": "net: add xmit recursion limit to tunnel xmit functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23276",
    "datePublished": "2026-03-20T08:08:56.575Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-05-23T16:04:28.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23276",
      "date": "2026-09-16",
      "epss": "0.00128",
      "percentile": "0.02826"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:52:16.000Z",
      "cve": "CVE-2026-23276",
      "id": "msrc_CVE-2026-23276",
      "initial_release_date": "2026-03-21T01:01:49.000Z",
      "product_status:known_affected": "11",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: add xmit recursion limit to tunnel xmit functions",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23276.json",
      "version": "11"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23276\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-20T09:16:13.370\",\"lastModified\":\"2026-06-17T10:21:14.330\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: add xmit recursion limit to tunnel xmit functions\\n\\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\\nrecursion limit. When a bond device in broadcast mode has GRE tap\\ninterfaces as slaves, and those GRE tunnels route back through the\\nbond, multicast/broadcast traffic triggers infinite recursion between\\nbond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing\\nkernel stack overflow.\\n\\nThe existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not\\nsufficient because tunnel recursion involves route lookups and full IP\\noutput, consuming much more stack per level. Use a lower limit of 4\\n(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.\\n\\nAdd recursion detection using dev_xmit_recursion helpers directly in\\niptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel\\npaths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).\\n\\nMove dev_xmit_recursion helpers from net/core/dev.h to public header\\ninclude/linux/netdevice.h so they can be used by tunnel code.\\n\\n BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160\\n Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11\\n Workqueue: mld mld_ifc_work\\n Call Trace:\\n  \u003cTASK\u003e\\n  __build_flow_key.constprop.0 (net/ipv4/route.c:515)\\n  ip_rt_update_pmtu (net/ipv4/route.c:1073)\\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  sch_direct_xmit (net/sched/sch_generic.c:347)\\n  __dev_queue_xmit (net/core/dev.c:4802)\\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  __dev_queue_xmit (net/core/dev.c:4841)\\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\\n  ip_output (net/ipv4/ip_output.c:438)\\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  sch_direct_xmit (net/sched/sch_generic.c:347)\\n  __dev_queue_xmit (net/core/dev.c:4802)\\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  __dev_queue_xmit (net/core/dev.c:4841)\\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\\n  ip_output (net/ipv4/ip_output.c:438)\\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  sch_direct_xmit (net/sched/sch_generic.c:347)\\n  __dev_queue_xmit (net/core/dev.c:4802)\\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  __dev_queue_xmit (net/core/dev.c:4841)\\n  mld_sendpack\\n  mld_ifc_work\\n  process_one_work\\n  worker_thread\\n  \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet: a\u00f1adir l\u00edmite de recursi\u00f3n de xmit a las funciones xmit de t\u00fanel\\n\\nLas funciones xmit de t\u00fanel (iptunnel_xmit, ip6tunnel_xmit) carecen de su propio l\u00edmite de recursi\u00f3n. Cuando un dispositivo bond en modo broadcast tiene interfaces GRE tap como esclavos, y esos t\u00faneles GRE enrutan de vuelta a trav\u00e9s del bond, el tr\u00e1fico multicast/broadcast desencadena una recursi\u00f3n infinita entre bond_xmit_broadcast() y ip_tunnel_xmit()/ip6_tnl_xmit(), causando un desbordamiento de pila del kernel.\\n\\nEl XMIT_RECURSION_LIMIT (8) existente en la ruta sin qdisc no es suficiente porque la recursi\u00f3n del t\u00fanel implica b\u00fasquedas de ruta y salida IP completa, consumiendo mucha m\u00e1s pila por nivel. Use un l\u00edmite inferior de 4 (IP_TUNNEL_RECURSION_LIMIT) para prevenir el desbordamiento.\\n\\nA\u00f1ada detecci\u00f3n de recursi\u00f3n usando las funciones auxiliares dev_xmit_recursion directamente en iptunnel_xmit() y ip6tunnel_xmit() para cubrir todas las rutas de t\u00fanel IPv4/IPv6, incluyendo los t\u00faneles encapsulados UDP (VXLAN, Geneve, etc.).\\n\\nMueva las funciones auxiliares dev_xmit_recursion de net/core/dev.h al encabezado p\u00fablico include/linux/netdevice.h para que puedan ser usadas por el c\u00f3digo del t\u00fanel.\\n\\nBUG: KASAN: pila-fuera-de-l\u00edmites en blake2s.constprop.0+0xe7/0x160\\nEscritura de tama\u00f1o 32 en la direcci\u00f3n ffff88810033fed0 por la tarea kworker/0:1/11\\nCola de trabajo: mld mld_ifc_work\\nRastro de Llamada:\\n \\n __build_flow_key.constprop.0 (net/ipv4/route.c:515)\\n ip_rt_update_pmtu (net/ipv4/route.c:1073)\\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\\n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n dev_hard_start_xmit (net/core/dev.c:3887)\\n sch_direct_xmit (net/sched/sch_generic.c:347)\\n __dev_queue_xmit (net/core/dev.c:4802)\\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\\n dev_hard_start_xmit (net/core/dev.c:3887)\\n __dev_queue_xmit (net/core/dev.c:4841)\\n ip_finish_output2 (net/ipv4/ip_output.c:237)\\n ip_output (net/ipv4/ip_output.c:438)\\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n dev_hard_start_xmit (net/core/dev.c:3887)\\n sch_direct_xmit (net/sched/sch_generic.c:347)\\n __dev_queue_xmit (net/core/dev.c:4802)\\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\\n dev_hard_start_xmit (net/core/dev.c:3887)\\n __dev_queue_xmit (net/core/dev.c:4841)\\n ip_finish_output2 (net/ipv4/ip_output.c:237)\\n ip_output (net/ipv4/ip_output.c:438)\\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\\n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n dev_hard_start_xmit (net/core/dev.c:3887)\\n sch_direct_xmit (net/sched/sch_generic.c:347)\\n __dev_queue_xmit (net/core/dev.c:4802)\\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\\n dev_hard_start_xmit (net/core/dev.c:3887)\\n __dev_queue_xmit (net/core/dev.c:4841)\\n mld_sendpack\\n mld_ifc_work\\n process_one_work\\n worker_thread\\n \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/netdevice.h\",\"include/net/ip6_tunnel.h\",\"include/net/ip_tunnels.h\",\"net/core/dev.h\",\"net/ipv4/ip_tunnel_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"745e20f1b626b1be4b100af5d4bf7b3439392f8f\",\"lessThan\":\"834c4f645726a25fd71ea50cdfb5c135f8f95d85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"745e20f1b626b1be4b100af5d4bf7b3439392f8f\",\"lessThan\":\"8a57deeb256069f262957d8012418559ff66c385\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"745e20f1b626b1be4b100af5d4bf7b3439392f8f\",\"lessThan\":\"b56b8d19bd05e2a8338385c770bc2b60590bc81e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"745e20f1b626b1be4b100af5d4bf7b3439392f8f\",\"lessThan\":\"6f1a9140ecda3baba3d945b9a6155af4268aafc4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3f266b04185de51d8e6446eb1fccec3b5e7ce575\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2.6.35.9\",\"lessThan\":\"2.6.36\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/netdevice.h\",\"include/net/ip6_tunnel.h\",\"include/net/ip_tunnels.h\",\"net/core/dev.h\",\"net/ipv4/ip_tunnel_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.37\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.37\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.35.9\",\"versionEndExcluding\":\"2.6.36\",\"matchCriteriaId\":\"BB30F95D-9634-492E-93DE-1F7552FA5CB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.37\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"E97A7946-FFE5-4F91-86FB-DE0F43365250\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"D394AC60-6F28-435F-872A-CCDF384B8331\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b56b8d19bd05e2a8338385c770bc2b60590bc81e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T19:11:02+00:00",
      "cve": "CVE-2026-23276",
      "id": "CVE-2026-23276",
      "initial_release_date": "2026-03-20T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: add xmit recursion limit to tunnel xmit functions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23276.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T01:31:54Z",
      "cve": "CVE-2026-23276",
      "id": "CVE-2026-23276",
      "initial_release_date": "2026-03-22T00:24:31Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "618",
      "product_status:known_not_affected": "15",
      "product_status:recommended": "332",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23276",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23276.json",
      "version": "21"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.