Junglewise Threat Intelligence

CVE-2026-23011: Linux Kernel denial of service in ipgre_header

CVE-2026-23011 · Severity: medium · CVSS 5.5 · Published 2026-01-25

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local attacker to crash the system. The issue occurs when the system handles specific types of tunneled network traffic (GRE) in combination with certain network interface configurations. This results in a kernel panic, leading to a complete denial of service for the affected device.

Technical details

The vulnerability is a kernel panic (skb_under_panic) within the net/ipv4/ip_gre.c component of the Linux kernel. It is caused by ipgre_header() failing to ensure sufficient headroom exists in a socket buffer (skb) before calling skb_push(). This occurs when team or bonding drivers dynamically change their required headroom or header length while an ipgre device is attached. A local attacker can trigger this condition to cause a kernel BUG at net/core/skbuff.c:213, resulting in a denial of service. The fix involves adding a check for sufficient headroom and expanding the header if necessary using pskb_expand_head() before proceeding with the GRE header insertion.

Affected products

  • Linux Linux Kernel versions prior to 6.13, 6.12.11, 6.11.11, 6.6.74, 6.1.127, 5.15.178, 5.10.234, 5.4.290
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-08: disclosed: Initial patch submitted by Eric Dumazet
  • 2026-01-23: patched: Patches merged into various stable kernel branches
  • 2026-01-25: advisory: CVE published to NVD

References

Related threats