CVE-2026-23459

CVE-2026-23459

High · published April 3, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS

Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which

call iptunnel_xmit_stats().

iptunnel_xmit_stats() was assuming tunnels were only using

NETDEV_PCPU_STAT_TSTATS.

@syncp offset in pcpu_sw_netstats and pcpu_dstats is different.

32bit kernels would either have corruptions or freezes if the syncp

sequence was overwritten.

This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid

a potential cache line miss since iptunnel_xmit_stats() needs to read it.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Published
2026-04-03T20:16Z
Affected products (5)
ProductVersionsFixed in
linux/linux_kernel≥ 6.14, < 6.19.106.19.10
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
EPSS history
Timeline
  • 03 APR 15:15Z
    ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
    cvelistv5