---
id: CVE-2026-23276
title: 'net: add xmit recursion limit to tunnel xmit functions'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: add xmit recursion limit to tunnel xmit functions

  Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own
  recursion limit. When a bond device in broa…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f <
    da5f0166cef3d4285ddbb1b638661263fc03ee92
  - >-
    Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f <
    834c4f645726a25fd71ea50cdfb5c135f8f95d85
  - >-
    Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f <
    8a57deeb256069f262957d8012418559ff66c385
  - >-
    Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f <
    b56b8d19bd05e2a8338385c770bc2b60590bc81e
  - >-
    Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f <
    6f1a9140ecda3baba3d945b9a6155af4268aafc4
  - Linux 3f266b04185de51d8e6446eb1fccec3b5e7ce575
  - Linux >= 2.6.35.9 < 2.6.36
  - Linux 2.6.37
published: '2026-03-20'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:04.913Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23276'
references:
  - url: 'https://git.kernel.org/stable/c/da5f0166cef3d4285ddbb1b638661263fc03ee92'
  - url: 'https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85'
  - url: 'https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385'
  - url: 'https://git.kernel.org/stable/c/b56b8d19bd05e2a8338385c770bc2b60590bc81e'
  - url: 'https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4'
tags:
  - cve.org
epss: 0.0013
epssPercentile: 0.02383
ingestedAt: '2026-10-21T12:48:53.668Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: add xmit recursion limit to tunnel xmit functions

Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own
recursion limit. When a bond device in broadcast mode has GRE tap
interfaces as slaves, and those GRE tunnels route back through the
bond, multicast/broadcast traffic triggers infinite recursion between
bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing
kernel stack overflow.

The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not
sufficient because tunnel recursion involves route lookups and full IP
output, consuming much more stack per level. Use a lower limit of 4
(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.

Add recursion detection using dev_xmit_recursion helpers directly in
iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel
paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).

Move dev_xmit_recursion helpers from net/core/dev.h to public header
include/linux/netdevice.h so they can be used by tunnel code.

 BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160
 Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11
 Workqueue: mld mld_ifc_work
 Call Trace:
  <TASK>
  __build_flow_key.constprop.0 (net/ipv4/route.c:515)
  ip_rt_update_pmtu (net/ipv4/route.c:1073)
  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)
  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
  gre_tap_xmit (net/ipv4/ip_gre.c:779)
  dev_hard_start_xmit (net/core/dev.c:3887)
  sch_direct_xmit (net/sched/sch_generic.c:347)
  __dev_queue_xmit (net/core/dev.c:4802)
  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)
  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)
  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)
  dev_hard_start_xmit (net/core/dev.c:3887)
  __dev_queue_xmit (net/core/dev.c:4841)
  ip_finish_output2 (net/ipv4/ip_output.c:237)
  ip_output (net/ipv4/ip_output.c:438)
  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)
  gre_tap_xmit (net/ipv4/ip_gre.c:779)
  dev_hard_start_xmit (net/core/dev.c:3887)
  sch_direct_xmit (net/sched/sch_generic.c:347)
  __dev_queue_xmit (net/core/dev.c:4802)
  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)
  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)
  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)
  dev_hard_start_xmit (net/core/dev.c:3887)
  __dev_queue_xmit (net/core/dev.c:4841)
  ip_finish_output2 (net/ipv4/ip_output.c:237)
  ip_output (net/ipv4/ip_output.c:438)
  iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)
  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
  gre_tap_xmit (net/ipv4/ip_gre.c:779)
  dev_hard_start_xmit (net/core/dev.c:3887)
  sch_direct_xmit (net/sched/sch_generic.c:347)
  __dev_queue_xmit (net/core/dev.c:4802)
  bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)
  bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)
  bond_start_xmit (drivers/net/bonding/bond_main.c:5530)
  dev_hard_start_xmit (net/core/dev.c:3887)
  __dev_queue_xmit (net/core/dev.c:4841)
  mld_sendpack
  mld_ifc_work
  process_one_work
  worker_thread
  </TASK>

## Affected

- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < da5f0166cef3d4285ddbb1b638661263fc03ee92`
- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 834c4f645726a25fd71ea50cdfb5c135f8f95d85`
- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 8a57deeb256069f262957d8012418559ff66c385`
- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < b56b8d19bd05e2a8338385c770bc2b60590bc81e`
- `Linux >= 745e20f1b626b1be4b100af5d4bf7b3439392f8f < 6f1a9140ecda3baba3d945b9a6155af4268aafc4`
- `Linux 3f266b04185de51d8e6446eb1fccec3b5e7ce575`
- `Linux >= 2.6.35.9 < 2.6.36`
- `Linux 2.6.37`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.