Executive brief
A vulnerability exists in the Linux kernel's networking component responsible for handling IP tunnels, such as those used in virtualized environments. On 32-bit systems, this flaw can lead to memory corruption or system freezes when processing network traffic through specific tunnel types like VXLAN or GENEVE. This could result in a total loss of system availability or unpredictable behavior in affected environments.
Technical details
A vulnerability in iptunnel_xmit_stats() within the Linux kernel arises from an incorrect assumption regarding per-CPU statistics structures. The function assumed tunnels only used NETDEV_PCPU_STAT_TSTATS, but components like VXLAN and GENEVE utilize NETDEV_PCPU_STAT_DSTATS. Because the @syncp offset differs between pcpu_sw_netstats and pcpu_dstats, 32-bit kernels may experience syncp sequence overwrites. This leads to memory corruption or kernel freezes. The issue is reachable via network traffic processed through affected tunnel interfaces. Patches have been released to adapt iptunnel_xmit_stats() to correctly handle both statistic types.
Affected products
- Linux Linux Kernel 6.14 to 6.19.10
Timeline
- 2026-03-11: other: Patch authored
- 2026-04-03: disclosed: CVE published
- 2026-05-26: advisory: NVD initial analysis completed