CVE-2026-23459 json
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
published 2026-04-03 7 mo ago modified 2026-10-21 19 d ago also EUVD-2026-18718
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats().
iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS.
@syncp offset in pcpu_sw_netstats and pcpu_dstats is different.
32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten.
This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_stats() needs to read it.
Patch / fix
- Linux Linux 6.6.160, 6.18.50, 6.19.10, 7.0
- linux Debian 14 6.19.10-1
debian advisories DEBIAN-CVE-2026-23459
- git.kernel.org/stable/c/127c5e6e2d6fa8185314537c08204ec3515eae99 commit
- git.kernel.org/stable/c/e40e2d11ced8119d3e4469ebe91264bc1cf71530 commit
- git.kernel.org/stable/c/5d562153b4719234227f99c2fb529f98a6a44d15 commit
- git.kernel.org/stable/c/0d087d00161f562d5047cc4009bb0c6a19daf9f1 commit
- git.kernel.org/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132 commit
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-23459 updated
kernel: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/127c5e6e2d6fa8185314537c08204ec3515eae99
- git.kernel.org /stable/c/e40e2d11ced8119d3e4469ebe91264bc1cf71530
- git.kernel.org /stable/c/5d562153b4719234227f99c2fb529f98a6a44d15
-
git.kernel.org
/stable/c/0d087d00161f562d5047cc4009bb0c6a19daf9f1
patch
-
git.kernel.org
/stable/c/8431c602f551549f082bbfa67f3003f2d8e3e132
patch
Sources
- CVE List CVE-2026-23459
- NVD CVE-2026-23459
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.