CVE-2026-23277 - Vulnerability Details

- net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit

teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit
through slave devices, but does not update skb->dev to the slave device
beforehand.

When a gretap tunnel is a TEQL slave, the transmit path reaches
iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0
master) and later calls iptunnel_xmit_stats(dev, pkt_len). This
function does:

get_cpu_ptr(dev->tstats)

Since teql_master_setup() does not set dev->pcpu_stat_type to
NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats
for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes
NULL + __per_cpu_offset[cpu], resulting in a page fault.

BUG: unable to handle page fault for address: ffff8880e6659018
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 68bc067 P4D 68bc067 PUD 0
Oops: Oops: 0002 [#1] SMP KASAN PTI
RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)
Call Trace:
<TASK>
ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
__gre_xmit (net/ipv4/ip_gre.c:478)
gre_tap_xmit (net/ipv4/ip_gre.c:779)
teql_master_xmit (net/sched/sch_teql.c:319)
dev_hard_start_xmit (net/core/dev.c:3887)
sch_direct_xmit (net/sched/sch_generic.c:347)
__dev_queue_xmit (net/core/dev.c:4802)
neigh_direct_output (net/core/neighbour.c:1660)
ip_finish_output2 (net/ipv4/ip_output.c:237)
__ip_finish_output.part.0 (net/ipv4/ip_output.c:315)
ip_mc_output (net/ipv4/ip_output.c:369)
ip_send_skb (net/ipv4/ip_output.c:1508)
udp_send_skb (net/ipv4/udp.c:1195)
udp_sendmsg (net/ipv4/udp.c:1485)
inet_sendmsg (net/ipv4/af_inet.c:859)
__sys_sendto (net/socket.c:2206)

Fix this by setting skb->dev = slave before calling
netdev_start_xmit(), so that tunnel xmit functions see the correct
slave device with properly allocated tstats.

Published: 2026-03-20

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability involves a NULL pointer dereference in the Linux kernel's net/sched:teql scheduler path. When a GRE tunnel functions as a TEQL slave, the kernel incorrectly leaves skb->dev pointing to the master device, causing iptunnel_xmit to reference uninitialized per‑CPU statistics and trigger a page fault. The resulting kernel crash (KASAN Oops) brings the system to an unavailable state, effectively a denial of service.

Affected Systems

Affected systems are any Linux kernel installations that enable the TEQL scheduler and use GRE tap tunnels as TEQL slaves. This includes most Linux distributions that ship with a standard kernel prior to the patch commit that properly sets skb->dev. No specific version range is listed, so all kernels before the fix are potentially vulnerable in the default configuration.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests low exploitation probability. The vulnerability is not in KEV. Based on the description, it is inferred that an attacker can exploit this by sending crafted traffic through an exposed TEQL‑enabled GRE tap tunnel; no local privileges are required. Successful exploitation results in a local system crash, limiting the impact to the compromised host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`039f50629b7f860f36644ed1f34b27da9aa62f43`	affected	< 57c153249143333bbf4ecf927bdf8aa2696ee397
`039f50629b7f860f36644ed1f34b27da9aa62f43`	affected	< 59b06d8b9bdb6b64b3c534c18da68bce5ccd31be
`039f50629b7f860f36644ed1f34b27da9aa62f43`	affected	< 81a43e8005366f16e629d8c95dfe05beaa8d36a7
`039f50629b7f860f36644ed1f34b27da9aa62f43`	affected	< 0bad9c86edd22dec4df83c2b29872d66fd8a2ff4
`039f50629b7f860f36644ed1f34b27da9aa62f43`	affected	< 21ea283c2750c8307aa35ee832b0951cc993c27d
`039f50629b7f860f36644ed1f34b27da9aa62f43`	affected	< 0cc0c2e661af418bbf7074179ea5cfffc0a5c466

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.19`	unaffected	≤ 6.18.*
`6.19.9`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[039f50629b7f860f36644ed1f34b27da9aa62f43,0bad9c86edd22dec4df83c2b29872d66fd8a2ff4)`	affected	code_commit	—
`[039f50629b7f860f36644ed1f34b27da9aa62f43,21ea283c2750c8307aa35ee832b0951cc993c27d)`	affected	code_commit	—
`[039f50629b7f860f36644ed1f34b27da9aa62f43,0cc0c2e661af418bbf7074179ea5cfffc0a5c466)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.5`	affected	semver	—
`[0,4.5)`	unaffected	semver	—
`[6.18.19,6.19.0)`	unaffected	semver	—
`[6.19.9,6.20.0)`	unaffected	semver	—
`[7.0-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Check your kernel version with uname -r and verify that the commit that sets skb->dev to the TEQL slave device is present in the local tree.
If the kernel is out of date, install the latest security update from your distribution’s package manager or build a new kernel that contains the patch.
As an interim measure, disable the TEQL scheduler or remove TEQL functionality if your environment does not require it.
Continuously monitor kernel logs (e.g., dmesg, /var/log/kern.log) for Oops or panic messages that indicate the vulnerability has been triggered.
If your system is frequently exposed to untrusted external networks using GRE tap tunnels, consider restricting the network interfaces or applying firewall rules to limit traffic.

Generated by OpenCVE AI on March 21, 2026 at 07:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0bad9c86edd22dec4df83c2b29872d66fd8a2ff4
https://git.kernel.org/stable/c/0cc0c2e661af418bbf7074179ea5cfffc0a5c466
https://git.kernel.org/stable/c/21ea283c2750c8307aa35ee832b0951cc993c27d
https://git.kernel.org/stable/c/57c153249143333bbf4ecf927bdf8aa2696ee397
https://git.kernel.org/stable/c/59b06d8b9bdb6b64b3c534c18da68bce5ccd31be
https://git.kernel.org/stable/c/81a43e8005366f16e629d8c95dfe05beaa8d36a7
https://lore.kernel.org/linux-cve-announce/2026032036-CVE-2026-23277-e478@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23277
https://www.cve.org/CVERecord?id=CVE-2026-23277

History

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/57c153249143333bbf4ecf927bdf8aa2696ee397 https://git.kernel.org/stable/c/59b06d8b9bdb6b64b3c534c18da68bce5ccd31be https://git.kernel.org/stable/c/81a43e8005366f16e629d8c95dfe05beaa8d36a7

Sat, 21 Mar 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026032036-CVE-2026-23277-e478@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23277 https://www.cve.org/CVERecord?id=CVE-2026-23277
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 20 Mar 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Fri, 20 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 20 Mar 2026 08:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the slave device beforehand. When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0 master) and later calls iptunnel_xmit_stats(dev, pkt_len). This function does: get_cpu_ptr(dev->tstats) Since teql_master_setup() does not set dev->pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes NULL + __per_cpu_offset[cpu], resulting in a page fault. BUG: unable to handle page fault for address: ffff8880e6659018 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 68bc067 P4D 68bc067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89) Call Trace: <TASK> ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) __gre_xmit (net/ipv4/ip_gre.c:478) gre_tap_xmit (net/ipv4/ip_gre.c:779) teql_master_xmit (net/sched/sch_teql.c:319) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) neigh_direct_output (net/core/neighbour.c:1660) ip_finish_output2 (net/ipv4/ip_output.c:237) __ip_finish_output.part.0 (net/ipv4/ip_output.c:315) ip_mc_output (net/ipv4/ip_output.c:369) ip_send_skb (net/ipv4/ip_output.c:1508) udp_send_skb (net/ipv4/udp.c:1195) udp_sendmsg (net/ipv4/udp.c:1485) inet_sendmsg (net/ipv4/af_inet.c:859) __sys_sendto (net/socket.c:2206) Fix this by setting skb->dev = slave before calling netdev_start_xmit(), so that tunnel xmit functions see the correct slave device with properly allocated tstats.
Title		net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0bad9c86edd22dec4df83c2b29872d66fd8a2ff4 https://git.kernel.org/stable/c/0cc0c2e661af418bbf7074179ea5cfffc0a5c466 https://git.kernel.org/stable/c/21ea283c2750c8307aa35ee832b0951cc993c27d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-20T08:08:57.394Z

Updated: 2026-04-13T06:03:27.710Z

Reserved: 2026-01-13T15:37:45.991Z

Link: CVE-2026-23277

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-20T09:16:13.533

Modified: 2026-03-25T11:16:21.993

Link: CVE-2026-23277

Redhat

Severity : Moderate

Publid Date: 2026-03-20T00:00:00Z

Links: CVE-2026-23277 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-25T14:29:58Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object