GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23277 (GCVE-0-2026-23277)

Vulnerability from cvelistv5 – Published: 2026-03-20 08:08 – Updated: 2026-09-08 08:45
VLAI
Title
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit through slave devices, but does not update skb->dev to the slave device beforehand. When a gretap tunnel is a TEQL slave, the transmit path reaches iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0 master) and later calls iptunnel_xmit_stats(dev, pkt_len). This function does: get_cpu_ptr(dev->tstats) Since teql_master_setup() does not set dev->pcpu_stat_type to NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes NULL + __per_cpu_offset[cpu], resulting in a page fault. BUG: unable to handle page fault for address: ffff8880e6659018 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 68bc067 P4D 68bc067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89) Call Trace: <TASK> ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847) __gre_xmit (net/ipv4/ip_gre.c:478) gre_tap_xmit (net/ipv4/ip_gre.c:779) teql_master_xmit (net/sched/sch_teql.c:319) dev_hard_start_xmit (net/core/dev.c:3887) sch_direct_xmit (net/sched/sch_generic.c:347) __dev_queue_xmit (net/core/dev.c:4802) neigh_direct_output (net/core/neighbour.c:1660) ip_finish_output2 (net/ipv4/ip_output.c:237) __ip_finish_output.part.0 (net/ipv4/ip_output.c:315) ip_mc_output (net/ipv4/ip_output.c:369) ip_send_skb (net/ipv4/ip_output.c:1508) udp_send_skb (net/ipv4/udp.c:1195) udp_sendmsg (net/ipv4/udp.c:1485) inet_sendmsg (net/ipv4/af_inet.c:859) __sys_sendto (net/socket.c:2206) Fix this by setting skb->dev = slave before calling netdev_start_xmit(), so that tunnel xmit functions see the correct slave device with properly allocated tstats.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 383493b9940e3d1b5517424081b3e072e20ec43c (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 6b1f563d670162e188a0f2aec39c24b67b106e17 (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 57c153249143333bbf4ecf927bdf8aa2696ee397 (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 59b06d8b9bdb6b64b3c534c18da68bce5ccd31be (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 81a43e8005366f16e629d8c95dfe05beaa8d36a7 (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 0bad9c86edd22dec4df83c2b29872d66fd8a2ff4 (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 21ea283c2750c8307aa35ee832b0951cc993c27d (git)
Affected: 039f50629b7f860f36644ed1f34b27da9aa62f43 , < 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.5
Unaffected: 0 , < 4.5 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.19 , ≤ 6.18.* (semver)
Unaffected: 6.19.9 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:45:19.497Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "383493b9940e3d1b5517424081b3e072e20ec43c",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "6b1f563d670162e188a0f2aec39c24b67b106e17",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "57c153249143333bbf4ecf927bdf8aa2696ee397",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "59b06d8b9bdb6b64b3c534c18da68bce5ccd31be",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "81a43e8005366f16e629d8c95dfe05beaa8d36a7",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "0bad9c86edd22dec4df83c2b29872d66fd8a2ff4",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "21ea283c2750c8307aa35ee832b0951cc993c27d",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            },
            {
              "lessThan": "0cc0c2e661af418bbf7074179ea5cfffc0a5c466",
              "status": "affected",
              "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit\n\nteql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit\nthrough slave devices, but does not update skb-\u003edev to the slave device\nbeforehand.\n\nWhen a gretap tunnel is a TEQL slave, the transmit path reaches\niptunnel_xmit() which saves dev = skb-\u003edev (still pointing to teql0\nmaster) and later calls iptunnel_xmit_stats(dev, pkt_len). This\nfunction does:\n\n    get_cpu_ptr(dev-\u003etstats)\n\nSince teql_master_setup() does not set dev-\u003epcpu_stat_type to\nNETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats\nfor teql0, so dev-\u003etstats is NULL. get_cpu_ptr(NULL) computes\nNULL + __per_cpu_offset[cpu], resulting in a page fault.\n\n BUG: unable to handle page fault for address: ffff8880e6659018\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 68bc067 P4D 68bc067 PUD 0\n Oops: Oops: 0002 [#1] SMP KASAN PTI\n RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)\n Call Trace:\n  \u003cTASK\u003e\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n  __gre_xmit (net/ipv4/ip_gre.c:478)\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\n  teql_master_xmit (net/sched/sch_teql.c:319)\n  dev_hard_start_xmit (net/core/dev.c:3887)\n  sch_direct_xmit (net/sched/sch_generic.c:347)\n  __dev_queue_xmit (net/core/dev.c:4802)\n  neigh_direct_output (net/core/neighbour.c:1660)\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\n  __ip_finish_output.part.0 (net/ipv4/ip_output.c:315)\n  ip_mc_output (net/ipv4/ip_output.c:369)\n  ip_send_skb (net/ipv4/ip_output.c:1508)\n  udp_send_skb (net/ipv4/udp.c:1195)\n  udp_sendmsg (net/ipv4/udp.c:1485)\n  inet_sendmsg (net/ipv4/af_inet.c:859)\n  __sys_sendto (net/socket.c:2206)\n\nFix this by setting skb-\u003edev = slave before calling\nnetdev_start_xmit(), so that tunnel xmit functions see the correct\nslave device with properly allocated tstats."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:03:45.245Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/383493b9940e3d1b5517424081b3e072e20ec43c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b1f563d670162e188a0f2aec39c24b67b106e17"
        },
        {
          "url": "https://git.kernel.org/stable/c/57c153249143333bbf4ecf927bdf8aa2696ee397"
        },
        {
          "url": "https://git.kernel.org/stable/c/59b06d8b9bdb6b64b3c534c18da68bce5ccd31be"
        },
        {
          "url": "https://git.kernel.org/stable/c/81a43e8005366f16e629d8c95dfe05beaa8d36a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bad9c86edd22dec4df83c2b29872d66fd8a2ff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ea283c2750c8307aa35ee832b0951cc993c27d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cc0c2e661af418bbf7074179ea5cfffc0a5c466"
        }
      ],
      "title": "net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23277",
    "datePublished": "2026-03-20T08:08:57.394Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-09-08T08:45:19.497Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23277",
      "date": "2026-09-17",
      "epss": "0.00122",
      "percentile": "0.02312"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-27T14:38:54.000Z",
      "cve": "CVE-2026-23277",
      "id": "msrc_CVE-2026-23277",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23277.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23277\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-20T09:16:13.533\",\"lastModified\":\"2026-07-14T13:18:28.530\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit\\n\\nteql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit\\nthrough slave devices, but does not update skb-\u003edev to the slave device\\nbeforehand.\\n\\nWhen a gretap tunnel is a TEQL slave, the transmit path reaches\\niptunnel_xmit() which saves dev = skb-\u003edev (still pointing to teql0\\nmaster) and later calls iptunnel_xmit_stats(dev, pkt_len). This\\nfunction does:\\n\\n    get_cpu_ptr(dev-\u003etstats)\\n\\nSince teql_master_setup() does not set dev-\u003epcpu_stat_type to\\nNETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats\\nfor teql0, so dev-\u003etstats is NULL. get_cpu_ptr(NULL) computes\\nNULL + __per_cpu_offset[cpu], resulting in a page fault.\\n\\n BUG: unable to handle page fault for address: ffff8880e6659018\\n #PF: supervisor write access in kernel mode\\n #PF: error_code(0x0002) - not-present page\\n PGD 68bc067 P4D 68bc067 PUD 0\\n Oops: Oops: 0002 [#1] SMP KASAN PTI\\n RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)\\n Call Trace:\\n  \u003cTASK\u003e\\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\\n  __gre_xmit (net/ipv4/ip_gre.c:478)\\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n  teql_master_xmit (net/sched/sch_teql.c:319)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  sch_direct_xmit (net/sched/sch_generic.c:347)\\n  __dev_queue_xmit (net/core/dev.c:4802)\\n  neigh_direct_output (net/core/neighbour.c:1660)\\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\\n  __ip_finish_output.part.0 (net/ipv4/ip_output.c:315)\\n  ip_mc_output (net/ipv4/ip_output.c:369)\\n  ip_send_skb (net/ipv4/ip_output.c:1508)\\n  udp_send_skb (net/ipv4/udp.c:1195)\\n  udp_sendmsg (net/ipv4/udp.c:1485)\\n  inet_sendmsg (net/ipv4/af_inet.c:859)\\n  __sys_sendto (net/socket.c:2206)\\n\\nFix this by setting skb-\u003edev = slave before calling\\nnetdev_start_xmit(), so that tunnel xmit functions see the correct\\nslave device with properly allocated tstats.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet/sched: teql: corrige la desreferenciaci\u00f3n de puntero NULL en iptunnel_xmit en la transmisi\u00f3n del esclavo TEQL\\n\\nteql_master_xmit() llama a netdev_start_xmit(skb, slave) para transmitir a trav\u00e9s de dispositivos esclavos, pero no actualiza skb-\u0026gt;dev al dispositivo esclavo de antemano.\\n\\nCuando un t\u00fanel gretap es un esclavo TEQL, la ruta de transmisi\u00f3n llega a iptunnel_xmit() que guarda dev = skb-\u0026gt;dev (todav\u00eda apuntando al maestro teql0) y luego llama a iptunnel_xmit_stats(dev, pkt_len). Esta funci\u00f3n hace:\\n\\n    get_cpu_ptr(dev-\u0026gt;tstats)\\n\\nDado que teql_master_setup() no establece dev-\u0026gt;pcpu_stat_type en NETDEV_PCPU_STAT_TSTATS, la pila de red central nunca asigna tstats para teql0, por lo que dev-\u0026gt;tstats es NULL. get_cpu_ptr(NULL) calcula NULL + __per_cpu_offset[cpu], lo que resulta en un fallo de p\u00e1gina.\\n\\n ERROR: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: ffff8880e6659018\\n #PF: acceso de escritura de supervisor en modo kernel\\n #PF: c\u00f3digo_de_error(0x0002) - p\u00e1gina no presente\\n PGD 68bc067 P4D 68bc067 PUD 0\\n Oops: Oops: 0002 [#1] SMP KASAN PTI\\n RIP: 0010:iptunnel_xmit (./include/net/ip_tunnels.h:664 net/ipv4/ip_tunnel_core.c:89)\\n Traza de Llamadas:\\n  \\n  ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\\n  __gre_xmit (net/ipv4/ip_gre.c:478)\\n  gre_tap_xmit (net/ipv4/ip_gre.c:779)\\n  teql_master_xmit (net/sched/sch_teql.c:319)\\n  dev_hard_start_xmit (net/core/dev.c:3887)\\n  sch_direct_xmit (net/sched/sch_generic.c:347)\\n  __dev_queue_xmit (net/core/dev.c:4802)\\n  neigh_direct_output (net/core/neighbour.c:1660)\\n  ip_finish_output2 (net/ipv4/ip_output.c:237)\\n  __ip_finish_output.part.0 (net/ipv4/ip_output.c:315)\\n  ip_mc_output (net/ipv4/ip_output.c:369)\\n  ip_send_skb (net/ipv4/ip_output.c:1508)\\n  udp_send_skb (net/ipv4/udp.c:1195)\\n  udp_sendmsg (net/ipv4/udp.c:1485)\\n  inet_sendmsg (net/ipv4/af_inet.c:859)\\n  __sys_sendto (net/socket.c:2206)\\n\\nSolucione esto estableciendo skb-\u0026gt;dev = slave antes de llamar a netdev_start_xmit(), para que las funciones de transmisi\u00f3n del t\u00fanel vean el dispositivo esclavo correcto con tstats correctamente asignados.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_teql.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"383493b9940e3d1b5517424081b3e072e20ec43c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"6b1f563d670162e188a0f2aec39c24b67b106e17\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"57c153249143333bbf4ecf927bdf8aa2696ee397\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"59b06d8b9bdb6b64b3c534c18da68bce5ccd31be\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"81a43e8005366f16e629d8c95dfe05beaa8d36a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"0bad9c86edd22dec4df83c2b29872d66fd8a2ff4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"21ea283c2750c8307aa35ee832b0951cc993c27d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"039f50629b7f860f36644ed1f34b27da9aa62f43\",\"lessThan\":\"0cc0c2e661af418bbf7074179ea5cfffc0a5c466\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_teql.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.253\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.19\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.9\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.5\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"5817BDB6-4C64-4AB6-83FF-CC693A5E4906\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"28D591F5-B196-4CC9-905C-DC80F116E7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.19\",\"matchCriteriaId\":\"D394AC60-6F28-435F-872A-CCDF384B8331\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.9\",\"matchCriteriaId\":\"E825E7C3-FEAC-4FD3-8A81-78D7387948C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0bad9c86edd22dec4df83c2b29872d66fd8a2ff4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0cc0c2e661af418bbf7074179ea5cfffc0a5c466\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21ea283c2750c8307aa35ee832b0951cc993c27d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/383493b9940e3d1b5517424081b3e072e20ec43c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/57c153249143333bbf4ecf927bdf8aa2696ee397\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59b06d8b9bdb6b64b3c534c18da68bce5ccd31be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b1f563d670162e188a0f2aec39c24b67b106e17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81a43e8005366f16e629d8c95dfe05beaa8d36a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-03T14:58:55+00:00",
      "cve": "CVE-2026-23277",
      "id": "CVE-2026-23277",
      "initial_release_date": "2026-03-20T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23277.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:24:57Z",
      "cve": "CVE-2026-23277",
      "id": "CVE-2026-23277",
      "initial_release_date": "2026-03-22T00:24:29Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "669",
      "product_status:known_not_affected": "34",
      "product_status:recommended": "303",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23277",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23277.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.