CVE-2026-23277: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23277 is a NULL pointer dereference vulnerability in the Linux kernel's TEQL (Trivial Equalizer) queue discipline (net/sched/sch_teql.c) that causes a kernel crash (denial of service) when a gretap tunnel is configured as a TEQL slave device. Disclosed on March 20, 2026, it affects Linux kernel versions from 4.5 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, and 6.19.9. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause (CWE-476: NULL Pointer Dereference) lies in teql_master_xmit(), which calls netdev_start_xmit(skb, slave) without first updating skb->dev to point to the slave device. When a gretap tunnel is the TEQL slave, the transmit path reaches iptunnel_xmit(), which captures dev = skb->dev — still pointing to the teql0 master — and subsequently calls iptunnel_xmit_stats(dev, pkt_len). Because teql_master_setup() never sets dev->pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS, the kernel never allocates per-CPU tstats for teql0, leaving dev->tstats as NULL. The call to get_cpu_ptr(NULL) then computes NULL + __per_cpu_offset[cpu], triggering a kernel page fault. The fix is to set skb->dev = slave before invoking netdev_start_xmit() (Red Hat Bugzilla).

Successful exploitation causes a kernel panic (page fault / Oops) on the affected system, resulting in a complete loss of availability for the host. A local user with low privileges who can configure or transmit traffic through a TEQL interface with a gretap tunnel slave can crash the kernel, affecting all processes and services running on the system. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory, Red Hat Bugzilla).

1. Gain local access: Obtain a low-privileged local user account on a Linux system running a vulnerable kernel version (4.5 through the unpatched stable branches).
2. Configure TEQL interface: Create a TEQL master interface (e.g., teql0) using tc or equivalent tools, requiring CAP_NET_ADMIN or equivalent privilege.
3. Add gretap tunnel as slave: Configure a gretap tunnel device and attach it as a slave to the TEQL master interface.
4. Trigger transmission: Send network traffic through the TEQL interface (e.g., via ping, udp socket, or any network utility) so that teql_master_xmit() is invoked and routes the packet through the gretap slave.
5. Kernel crash: The stale skb->dev pointer causes iptunnel_xmit_stats() to dereference a NULL tstats pointer, triggering a kernel page fault and system crash (Red Hat Bugzilla).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg containing BUG: unable to handle page fault for address followed by a call trace including iptunnel_xmit, ip_tunnel_xmit, __gre_xmit, gre_tap_xmit, and teql_master_xmit.
• Logs: Kernel crash dump (if kdump is configured) showing RIP: 0010:iptunnel_xmit and Oops: 0002 [#1] SMP KASAN PTI.
• Network: Presence of a teql0 or similar TEQL master interface (ip link show or tc qdisc show) with a gretap tunnel configured as a slave device on a vulnerable kernel version.
• System: Unexpected system reboots or kernel panics on hosts with TEQL and gretap tunnel configurations.

Apply kernel updates to the fixed stable versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, or 6.19.9, as appropriate for your distribution. Patches are available across multiple stable kernel branches via kernel.org (Red Hat Advisory). Distribution-specific updates have been released by Red Hat, SUSE (SUSE-SU-2026:1661-1, SUSE-SU-2026:1668-1), Debian (DSA-6238-1, DSA-6243-1, DLA-4561-1), and Amazon Linux 2023. As a workaround where patching is not immediately possible, avoid configuring gretap tunnel devices as TEQL slave interfaces, and restrict unprivileged user access to network device configuration (CAP_NET_ADMIN).