Junglewise Threat Intelligence

CVE-2026-23277: Linux Kernel NULL pointer dereference in TEQL scheduler

CVE-2026-23277 · Severity: info · CVSS 5.5 · Published 2026-03-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when specific network tunneling configurations (TEQL with gretap) are used, leading to a system "Oops" or kernel panic. This primarily impacts the availability of the server or device, potentially causing a denial-of-service.

Technical details

A NULL pointer dereference exists in net/sched/sch_teql.c within the teql_master_xmit() function. When a gretap tunnel is configured as a TEQL slave, the transmit path reaches iptunnel_xmit(), which attempts to access per-CPU statistics (tstats) on the master device. Because the TEQL master device does not allocate these statistics, the kernel attempts to access a NULL pointer, resulting in a page fault and kernel oops. The fix involves correctly updating the skb->dev pointer to the slave device before transmission. This vulnerability is reachable by a local user with sufficient privileges to configure or trigger network traffic over affected interfaces.

Affected products

  • Linux Linux Kernel 4.5 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9

Timeline

  • 2026-03-04: patched: Initial patch authored
  • 2026-03-20: advisory: CVE-2026-23277 published

References