Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-23276

In the Linux kernel, the following vulnerability has been resolved: net: add xmit recursion limit to tunnel xmit functions Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own recursion limit. When a bond device in broadcast mode has GRE tap interfaces as slaves, and those GRE tunnels route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing kernel stack overflow. The existing
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:fbf657a7ec42571f2e0f5fc030f8d1aaea0fa8d359d04c4d5d5bee83370c5ac5
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/netdevice.h","include/net/ip6_tunnel.h","include/net/ip_tunnels.h","net/core/dev.h","net/ipv4/ip_tunnel_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"834c4f645726a25fd71ea50cdfb5c135f8f95d85","status":"affected","version":"745e20f1b626b1be4b100af5d4bf7b3439392f8f","versionType":"git"},{"lessThan":"8a57deeb256069f262957d8012418559ff66c385","status":"affected","version":"745e20f1b626b1be4b100af5d4bf7b3439392f8f","versionType":"git"},{"lessT…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/netdevice.h","include/net/ip6_tunnel.h","include/net/ip_tunnels.h","net/core/dev.h","net/ipv4/ip_tunnel_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.37"},{"lessThan":"2.6.37","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.19","versionType":"semver…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/netdevice.h","include/net/ip6_tunnel.h","include/net/ip_tunnels.h","net/core/dev.h","net/ipv4/ip_tunnel_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"834c4f645726a25fd71ea50cdfb5c135f8f95d85","status":"affected","version":"745e20f1b626b1be4b100af5d4bf7b3439392f8f","versionType":"git"},{"lessThan":"8a57deeb256069f262957d8012418559ff66c385","status":"affected","version":"745e20f1b626b1be4b100af5d4bf7b3439392f8f","versionType":"git"},{"lessT…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/netdevice.h","include/net/ip6_tunnel.h","include/net/ip_tunnels.h","net/core/dev.h","net/ipv4/ip_tunnel_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.37"},{"lessThan":"2.6.37","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.19","versionType":"semver…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/affected/1

Source references

4 source assertions
{"url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/b56b8d19bd05e2a8338385c770bc2b60590bc81e"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0d22fe474d3e52798c4b40eded265c43e6199503543487b3716c7bd03e4dae49 · sha256:9835aafac815c666… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer