LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23459: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS

In the Linux kernel, the following vulnerability has been resolved: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats(). iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS. @syncp offset in pcpu_sw_netstats and pcpu_dstats is different. 32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten. This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_stats() needs to read it.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel networking flaw can corrupt statistics data or freeze affected 32-bit systems when VXLAN or Geneve tunnels transmit traffic. The supplied CVSS score is 8.2 because availability impact may be severe and network triggering is rated unauthenticated. No confidentiality impact is identified.

Executive priority

Treat this as a high-priority availability risk for 32-bit Linux infrastructure using overlay tunnels, especially network appliances, gateways, and container platforms. Patch those systems promptly after compatibility testing. Other Linux systems should be inventoried and vendor status confirmed, but the supplied evidence does not justify declaring a broad emergency or active attack.

Technical view

iptunnel_xmit_stats() incorrectly assumed NETDEV_PCPU_STAT_TSTATS while VXLAN and Geneve paths may use NETDEV_PCPU_STAT_DSTATS. Because the syncp field has different offsets in pcpu_sw_netstats and pcpu_dstats, 32-bit kernels may overwrite synchronization state, causing corruption or freezes. Referenced stable-kernel commits adapt the function to the correct statistics type.

Likely exposure

Exposure is most likely on affected 32-bit Linux kernels using VXLAN or Geneve tunnels. Systems without those tunnel paths, 64-bit systems, or versions confirmed fixed by their distributor may have lower or no exposure. The supplied version data is incomplete and includes ambiguous entries, so inventory should be matched against vendor advisories and fix commits.

Exploitation context

The supplied CVSS vector rates exploitation as network-accessible, low-complexity, unauthenticated, and requiring no user interaction. However, the bundle provides no trigger details beyond tunnel transmission paths. This CVE is not listed as KEV, and no supplied source establishes active exploitation or a public exploit.

Researcher notes

The defect is a per-CPU statistics-type mismatch in iptunnel_xmit_stats(), reached through udp_tunnel_xmit_skb() and its IPv6 counterpart. The consequence described is overwritten synchronization state on 32-bit kernels, producing corruption or freezes. No CWE, reproducer, affected configuration matrix, or exploitation telemetry is supplied. Version records contain duplicates and an ambiguous “0” entry.

Mitigation direction

  • Update to a Linux kernel release containing the applicable referenced stable fix.
  • Confirm the corrected package version with your Linux distribution or appliance vendor.
  • Prioritize exposed 32-bit hosts using VXLAN or Geneve networking.
  • Where updates are delayed, reduce reliance on affected tunnel interfaces after operational review.

Validation and detection

  • Inventory kernel versions and CPU architecture across Linux hosts.
  • Identify systems with active VXLAN or Geneve interfaces and traffic.
  • Compare deployed kernel source or vendor changelogs with the referenced fix commits.
  • After updating, verify the new kernel is running and tunnel networking remains stable.
  • Monitor affected hosts for freezes, networking faults, and unexpected statistics corruption.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23459 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H3.94.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2026-23459Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcb1c1f3b7ef908408064734fb6bdaf5811b8b84c, be226352e8dc77d3313c096b2d8e7f69bf6980fc, be226352e8dc77d3313c096b2d8e7f69bf6980fc, be226352e8dc77d3313c096b2d8e7f69bf6980fc, 1db9041e91ac574f1cecc0e98e69ac35832e8088, 6.6.153unaffected
LinuxLinux6.14, 0, 6.18.50, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.