CVE-2026-23011

MEDIUM EPSS 8.5%
Published Jan 25, 20265mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jan 25, 2026 5mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device. [1] skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0 kernel BUG at net/core/skbuff.c:213 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
8.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 15

VendorProductVersionRange
linuxlinux_kernel*≥3.10.1  –  <5.10.249
linuxlinux_kernel*≥5.11  –  <5.15.199
linuxlinux_kernel*≥5.16  –  <6.1.162
linuxlinux_kernel*≥6.2  –  <6.6.122
linuxlinux_kernel*≥6.7  –  <6.12.67
linuxlinux_kernel*≥6.13  –  <6.18.7
linuxlinux_kernel3.10any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any
linuxlinux_kernel6.19any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/06fe0801396a36cab865b34f666de1d65bc5ce8e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2ecf0aa7cc262472a9599cc51ba02ada0897a17a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/554201ed0a8f4d32e719f42caeaeb2735a9ed6ca
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8d5b6b2d79c1c22a5b0db1187a6439dff375a022
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/aa57bfea4674e6da8104fa3a37760a6f5f255dad
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e67c577d89894811ce4dcd1a9ed29d8b63476667
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/eeb9a521de40c6fadccc12fa5205e5a1b364d5a8
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/06fe0801396a36cab865b34f666de1d65bc5ce8e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2ecf0aa7cc262472a9599cc51ba02ada0897a17a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/554201ed0a8f4d32e719f42caeaeb2735a9ed6ca
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8d5b6b2d79c1c22a5b0db1187a6439dff375a022
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/aa57bfea4674e6da8104fa3a37760a6f5f255dad
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e67c577d89894811ce4dcd1a9ed29d8b63476667
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/eeb9a521de40c6fadccc12fa5205e5a1b364d5a8
    Patch