CVE-2026-23277

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit

teql_master_xmit() calls netdev_start_xmit(skb, slave) to transmit

through slave devices, but does not update skb->dev to the slave device

beforehand.

When a gretap tunnel is a TEQL slave, the transmit path reaches

iptunnel_xmit() which saves dev = skb->dev (still pointing to teql0

master) and later calls iptunnel_xmit_stats(dev, pkt_len). This

function does:

get_cpu_ptr(dev->tstats)

Since teql_master_setup() does not set dev->pcpu_stat_type to

NETDEV_PCPU_STAT_TSTATS, the core network stack never allocates tstats

for teql0, so dev->tstats is NULL. get_cpu_ptr(NULL) computes

NULL + __per_cpu_offset[cpu], resulting in a page fault.

BUG: unable to handle page fault for address: ffff8880e6659018

#PF: supervisor write access in kernel mode

#PF: error_code(0x0002) - not-present page

PGD 68bc067 P4D 68bc067 PUD 0

Oops: Oops: 0002

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References