CVE-2026-23276

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: add xmit recursion limit to tunnel xmit functions

Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own

recursion limit. When a bond device in broadcast mode has GRE tap

interfaces as slaves, and those GRE tunnels route back through the

bond, multicast/broadcast traffic triggers infinite recursion between

bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing

kernel stack overflow.

The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not

sufficient because tunnel recursion involves route lookups and full IP

output, consuming much more stack per level. Use a lower limit of 4

(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.

Add recursion detection using dev_xmit_recursion helpers directly in

iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel

paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).

Move dev_xmit_recursion helpers from net/core/dev.h to p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References