CVE-2026-23276: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23276 is a kernel denial-of-service vulnerability caused by missing recursion limits in the Linux kernel's tunnel transmit functions (iptunnel_xmit and ip6tunnel_xmit). When a bond device in broadcast mode uses GRE tap interfaces as slaves that route traffic back through the same bond, multicast/broadcast traffic triggers infinite recursion between bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), resulting in a kernel stack overflow. Affected kernel versions span from 2.6.37 up to (but not including) 6.12.78, 6.13 through 6.18.18, 6.19 through 6.19.8, and release candidates for 7.0 (rc1–rc3). It was disclosed on March 20, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is uncontrolled recursion (CWE-674) and an effectively unreachable exit condition (CWE-835) in the kernel's IPv4/IPv6 tunnel transmit paths. The existing XMIT_RECURSION_LIMIT of 8 in the no-qdisc path is insufficient for tunnel recursion because each level involves route lookups and full IP output, consuming significantly more kernel stack space per frame. The fix introduces a dedicated IP_TUNNEL_RECURSION_LIMIT of 4 and adds recursion detection via dev_xmit_recursion helpers directly in iptunnel_xmit() and ip6tunnel_xmit(), covering all IPv4/IPv6 tunnel paths including UDP-encapsulated tunnels such as VXLAN and Geneve. The dev_xmit_recursion helpers were also relocated from net/core/dev.h to the public header include/linux/netdevice.h to enable their use in tunnel code (Red Hat Bugzilla).

Successful exploitation causes a kernel stack overflow, crashing the affected system and resulting in a complete denial of service (availability impact: High). There is no confidentiality or integrity impact. The vulnerability requires a specific misconfigured network topology (bond device in broadcast mode with GRE tap slaves routing back through the bond), limiting its scope, but on affected systems a local low-privileged user can trigger the crash by sending multicast or broadcast traffic on such interfaces (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges and a specific misconfigured network topology involving bond and GRE tunnel interfaces (Red Hat Advisory).

Update to a patched Linux kernel version: 6.12.78 or later, 6.18.19 or later, 6.19.9 or later, or the 7.0 final release. Patches are available in the Linux kernel stable branches (git.kernel.org). Distribution-specific updates have been released by Red Hat, Debian (DSA-6238-1), SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), and Amazon Linux 2023 (ALAS2023-2026-1594). As a configuration-based workaround, avoid network topologies where GRE tunnel interfaces configured as bond slaves route traffic back through the same bond device, or restrict multicast/broadcast traffic on such interfaces (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was announced via the official Linux kernel CVE mailing list (linux-cve-announce) by Greg Kroah-Hartman on March 20, 2026. Red Hat, SUSE, Debian, and Amazon Linux have all issued security advisories and updated packages. No notable independent researcher commentary or significant social media discussion has been observed beyond routine CVE tracking.