{"id":"CVE-2026-23276","title":"net: add xmit recursion limit to tunnel xmit functions","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add xmit recursion limit to tunnel xmit functions\n\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\nrecursion limit. When a bond device in broa…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < da5f0166cef3d4285ddbb1b638661263fc03ee92","Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 834c4f645726a25fd71ea50cdfb5c135f8f95d85","Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 8a57deeb256069f262957d8012418559ff66c385","Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < b56b8d19bd05e2a8338385c770bc2b60590bc81e","Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 6f1a9140ecda3baba3d945b9a6155af4268aafc4","Linux 3f266b04185de51d8e6446eb1fccec3b5e7ce575","Linux >= 2.6.35.9 < 2.6.36","Linux 2.6.37"],"published":"2026-03-20","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:39:04.913Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23276","references":[{"url":"https://git.kernel.org/stable/c/da5f0166cef3d4285ddbb1b638661263fc03ee92"},{"url":"https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85"},{"url":"https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385"},{"url":"https://git.kernel.org/stable/c/b56b8d19bd05e2a8338385c770bc2b60590bc81e"},{"url":"https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"}],"tags":["cve.org"],"epss":0.0013,"epssPercentile":0.02383,"ingestedAt":"2026-10-21T12:48:53.668Z","slug":"CVE-2026-23276","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: add xmit recursion limit to tunnel xmit functions\n\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\nrecursion limit. When a bond device in broadcast mode has GRE tap\ninterfaces as slaves, and those GRE tunnels route back through the\nbond, multicast/broadcast traffic triggers infinite recursion between\nbond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing\nkernel stack overflow.\n\nThe existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not\nsufficient because tunnel recursion involves route lookups and full IP\noutput, consuming much more stack per level. Use a lower limit of 4\n(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.\n\nAdd recursion detection using dev_xmit_recursion helpers directly in\niptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel\npaths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).\n\nMove dev_xmit_recursion helpers from net/core/dev.h to public header\ninclude/linux/netdevice.h so they can be used by tunnel code.\n\n BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160\n Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11\n Workqueue: mld mld_ifc_work\n Call Trace:\n  <TASK>\n  __build_flow_key.constprop.0 (net/ipv4/route.c:515)\n  ip_rt_update_pmtu (net/ipv4/route.c:1073)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  ip_output (net/ipv4/ip_output.c:438)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  ip_output (net/ipv4/ip_output.c:438)\n  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  __dev_queue_xmit (net/core/dev.c:4841)\n  mld_sendpack\n  mld_ifc_work\n  process_one_work\n  worker_thread\n  </TASK>\n\n## Affected\n\n- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < da5f0166cef3d4285ddbb1b638661263fc03ee92`\n- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 834c4f645726a25fd71ea50cdfb5c135f8f95d85`\n- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 8a57deeb256069f262957d8012418559ff66c385`\n- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < b56b8d19bd05e2a8338385c770bc2b60590bc81e`\n- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 6f1a9140ecda3baba3d945b9a6155af4268aafc4`\n- `Linux 3f266b04185de51d8e6446eb1fccec3b5e7ce575`\n- `Linux >= 2.6.35.9 < 2.6.36`\n- `Linux 2.6.37`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}