CVE-2026-23459: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23459 is a memory corruption vulnerability in the Linux kernel's iptunnel_xmit_stats() function affecting VXLAN and Geneve tunnel implementations. The flaw arises because the function incorrectly assumes all tunnels use NETDEV_PCPU_STAT_TSTATS, while VXLAN and Geneve tunnels use NETDEV_PCPU_STAT_DSTATS via udp_tunnel[6]_xmit_skb(). Affected kernel versions include 6.14 through 6.19.9 and Linux 7.0-rc1 through 7.0-rc4. It was published on April 3, 2026, with patches available by May 2026. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory).

The root cause is a structural mismatch between two per-CPU statistics data structures: pcpu_sw_netstats (used by NETDEV_PCPU_STAT_TSTATS) and pcpu_dstats (used by NETDEV_PCPU_STAT_DSTATS). The @syncp field has a different offset in each structure, so when iptunnel_xmit_stats() writes to the syncp sequence assuming TSTATS layout on a system actually using DSTATS, it overwrites unintended memory. On 32-bit kernels, this results in memory corruption or system freezes. No CWE classification has been formally assigned, but the flaw is consistent with incorrect type assumption / improper data structure handling. The vulnerability is reachable via network traffic through VXLAN or Geneve tunnels without any authentication (GitHub Advisory).

Successful exploitation primarily impacts availability, causing system freezes or memory corruption on 32-bit Linux kernel systems running VXLAN or Geneve tunnels. There is a low integrity impact due to potential memory corruption side effects, but no confidentiality impact is expected. The vulnerability is particularly severe in network infrastructure environments where VXLAN/Geneve tunnels are used for overlay networking (e.g., container orchestration or SDN deployments), as a freeze or corruption could disrupt all traffic traversing the affected host (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is remotely exploitable with no authentication or user interaction required, lowering the barrier for potential abuse. The EPSS score is approximately 0.018% (0.000180), indicating a very low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The fix is included in Linux kernel version 6.19.10 and Linux 7.0-rc5 and later, via patches committed to the stable kernel tree (GitHub Advisory). Administrators should upgrade affected kernels to 6.19.10+ or apply the relevant stable patches (0d087d00161f562d5047cc4009bb0c6a19daf9f1 and 8431c602f551549f082bbfa67f3003f2d8e3e132). As a temporary workaround on 32-bit systems, consider disabling VXLAN and Geneve tunnel interfaces until the patch can be applied, particularly in environments where these tunnels are exposed to untrusted network traffic.