Linux Kernel up to 6.19.9/7.0-rc4 ip_tunnel iptunnel_xmit_stats denial of service

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.19.9/7.0-rc4. This affects the function iptunnel_xmit_stats of the component ip_tunnel. Performing a manipulation results in denial of service. This vulnerability is reported as CVE-2026-23459. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.19.9/7.0-rc4. It has been classified as critical. This affects the function iptunnel_xmit_stats of the component ip_tunnel. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS Blamed commits forgot that vxlan/geneve use udp_tunnel[6]_xmit_skb() which call iptunnel_xmit_stats(). iptunnel_xmit_stats() was assuming tunnels were only using NETDEV_PCPU_STAT_TSTATS. @syncp offset in pcpu_sw_netstats and pcpu_dstats is different. 32bit kernels would either have corruptions or freezes if the syncp sequence was overwritten. This patch also moves pcpu_stat_type closer to dev->{t,d}stats to avoid a potential cache line miss since iptunnel_xmit_stats() needs to read it.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-23459 since 01/13/2026. Technical details are known, but no exploit is available.

Upgrading to version 6.19.10 or 7.0-rc5 eliminates this vulnerability. Applying the patch 0d087d00161f562d5047cc4009bb0c6a19daf9f1/8431c602f551549f082bbfa67f3003f2d8e3e132 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8
• 6.19.9
• 7.0-rc1
• 7.0-rc2
• 7.0-rc3
• 7.0-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion