PT-2026-26582 · Linux · Linux Kernel

Published

2026-01-01

·

Updated

2026-04-23

·

CVE-2026-23277

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description A flaw exists in the Linux kernel's networking subsystem related to the TEQL (Traffic EQuation Language) scheduler. Specifically, a NULL pointer dereference can occur within the iptunnel xmit function when handling transmissions on a TEQL slave interface, such as a GRE tunnel. The issue arises because the skb->dev pointer is not updated to point to the slave device before being passed to netdev start xmit. This leads to iptunnel xmit stats being called with an invalid device pointer, resulting in a page fault when attempting to access the device's statistics (dev->tstats). The teql master xmit function calls netdev start xmit(skb, slave) to transmit through slave devices, but it does not update skb->dev to the slave device beforehand. When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel xmit() which saves dev = skb->dev (still pointing to the teql0 master) and later calls iptunnel xmit stats(dev, pkt len). This function attempts to access dev->tstats, which is NULL because teql master setup() does not set dev->pcpu stat type to NETDEV PCPU STAT TSTATS.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23277
ECHO-FE85-B4BB-BAF9
OESA-2026-1862
OESA-2026-1863
OESA-2026-1864
OPENSUSE-SU-2026:20572-1
SUSE-SU-2026:1573-1
SUSE-SU-2026:1661-1
SUSE-SU-2026:1668-1
SUSE-SU-2026:21114-1
SUSE-SU-2026:21123-1
SUSE-SU-2026:21237-1
SUSE-SU-2026:21255-1
SUSE-SU-2026:21352-1
SUSE-SU-2026:21361-1

Affected Products

Linux Kernel