CVE-2026-23459

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23459
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23459.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23459
Downstream
AZL (1)
BELL (1)
CGA (101)
DEBIAN (1)
UBUNTU (1)
Published
2026-04-03T15:15:39Z
Modified
2026-10-08T02:49:51Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator
Summary
ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
Details

In the Linux kernel, the following vulnerability has been resolved:

ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS

Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats().

iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS.

@syncp offset in pcpu_sw_netstats and pcpu_dstats is different.

32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten.

This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_stats() needs to read it.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23459.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cb1c1f3b7ef908408064734fb6bdaf5811b8b84c
Fixed
e40e2d11ced8119d3e4469ebe91264bc1cf71530
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
be226352e8dc77d3313c096b2d8e7f69bf6980fc
Fixed
5d562153b4719234227f99c2fb529f98a6a44d15
Fixed
0d087d00161f562d5047cc4009bb0c6a19daf9f1
Fixed
8431c602f551549f082bbfa67f3003f2d8e3e132
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.6.153
Fixed
6.7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1db9041e91ac574f1cecc0e98e69ac35832e8088

Affected versions

v6.*
v6.6.153
v6.6.154
v6.6.155
v6.6.156
v6.6.157
v6.6.158

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23459.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.14.0
Fixed
6.18.50
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.10

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23459.json"