Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when specific network configurations, such as bonded interfaces combined with GRE tunnels, process broadcast or multicast traffic. This can lead to an infinite loop that exhausts system memory (stack overflow), resulting in a kernel crash and service disruption.
Technical details
The vulnerability is classified as uncontrolled recursion (CWE-674) within the tunnel transmit functions (iptunnel_xmit and ip6tunnel_xmit). When a bonding device in broadcast mode uses GRE tap interfaces as slaves that route back through the bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and the tunnel transmit functions. Because tunnel recursion involves route lookups and full IP output, it consumes significant stack space. The fix introduces a specific IP_TUNNEL_RECURSION_LIMIT of 4 and implements recursion detection using dev_xmit_recursion helpers to prevent stack exhaustion. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux kernel 2.6.35.9 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-07: patched: Initial patch authored by Weiming Shi
- 2026-03-20: disclosed: CVE-2026-23276 published
- 2026-03-20: advisory: NVD entry created