Lucene search
+L

CVE-2026-23277

🗓️ 20 Mar 2026 08:08:57Reported by LinuxType 
cve
 cve
🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Fix NULL pointer dereference in iptunnel_xmit for TEQL slave transmit by setting skb->dev to the slave.

Related
Detection
Affected
Refs
Paths
NVD
Vulners
CNA
Node
OR
linuxlinux_kernelRange4.55.10.253
linuxlinux_kernelRange5.115.15.203
linuxlinux_kernelRange5.166.1.167
linuxlinux_kernelRange6.26.6.130
linuxlinux_kernelRange6.76.12.78
linuxlinux_kernelRange6.136.18.19
linuxlinux_kernelRange6.196.19.9
[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/sched/sch_teql.c"
    ],
    "versions": [
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "383493b9940e3d1b5517424081b3e072e20ec43c",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "6b1f563d670162e188a0f2aec39c24b67b106e17",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "57c153249143333bbf4ecf927bdf8aa2696ee397",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "59b06d8b9bdb6b64b3c534c18da68bce5ccd31be",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "81a43e8005366f16e629d8c95dfe05beaa8d36a7",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "0bad9c86edd22dec4df83c2b29872d66fd8a2ff4",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "21ea283c2750c8307aa35ee832b0951cc993c27d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "039f50629b7f860f36644ed1f34b27da9aa62f43",
        "lessThan": "0cc0c2e661af418bbf7074179ea5cfffc0a5c466",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/sched/sch_teql.c"
    ],
    "versions": [
      {
        "version": "4.5",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "4.5",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.253",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.203",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.167",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.130",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.78",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.19",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.19.9",
        "lessThanOrEqual": "6.19.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.0",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
skb->devpathnet/sched/sch_teql.c/teql_master_xmitTEQL master transmit path uses skb->dev before updating to slave device, causing downstream iptunnel_xmit to access NULL tstatsCWE-476
skb->devpathnet/ipv4/ip_tunnel_core.c/iptunnel_xmitiptunnel_xmit saves skb->dev (teql master) and accesses tstats via dev->tstats, leading to NULL pointer dereference when tstats not allocatedCWE-476
skb->devpathnet/ipv4/ip_tunnel.c/ip_tunnel_xmitip_tunnel_xmit path invoked by GRE/TEQL tunnel; relies on correct dev assignment and tstatsCWE-476
skb->devpathnet/ipv4/ip_gre.c/gre_tap_xmitgre_tap_xmit chain through TEQL slave path without ensuring skb->dev points to the slave, risking tstats accessCWE-476

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

14 Jul 2026 13:18Current
5.7Medium risk
Vulners AI Score5.7
CVSS 3.15.5
EPSS0.00122
30