CVE-2026-23011: Linux Kernel DOS Vulnerability in ip_gre

CVE-2026-23011 Overview

CVE-2026-23011 is a denial of service vulnerability in the Linux kernel's IPv4 Generic Routing Encapsulation (GRE) implementation. The flaw resides in the ipgre_header() function within net/ipv4/ip_gre.c. Syzbot fuzzing exposed multiple paths where the kernel crashes due to insufficient socket buffer (skb) headroom when team or bonding drivers dynamically change dev->needed_headroom or dev->hard_header_len. A local unprivileged user can trigger a kernel panic via skb_under_panic in skb_push(), leading to system unavailability. The fix mirrors an earlier patch applied to the IPv6 GRE counterpart (ip6gre_header()).

Critical Impact

Local attackers can crash the Linux kernel by manipulating GRE tunnel devices in conjunction with team or bonding drivers, resulting in a full system denial of service.

Affected Products

• Linux Kernel (multiple stable branches, including 6.19-rc1 through 6.19-rc8)
• Linux Kernel versions from 3.10 onward containing the original ipgre_header() implementation
• Distributions shipping unpatched kernels using IPv4 GRE with team or bonding drivers

Discovery Timeline

• 2026-01-25 - CVE-2026-23011 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23011

Vulnerability Analysis

The vulnerability is a kernel-level denial of service caused by an out-of-bounds write attempt against a socket buffer with insufficient headroom. The crash occurs in ipgre_header() at net/ipv4/ip_gre.c:897 when skb_push() is called to prepend GRE headers to an skb that was allocated with a smaller reserve than required.

The reported syzbot stack trace shows mld_newpack() allocating an skb based on the headroom available at allocation time. Before mld_sendpack() transmits the packet, an ipgre device is dynamically attached to a team0 interface. The new device requires a larger dev->needed_headroom, but the previously allocated skb cannot accommodate the GRE encapsulation, causing skb_under_panic at net/core/skbuff.c:213 and a kernel BUG.

The issue is classified as a kernel logic flaw in network header construction [CWE-NVD-noinfo].

Root Cause

The root cause is the absence of defensive length and headroom validation inside ipgre_header(). The function assumes the skb has enough headroom for the GRE header without verifying it at the time of header insertion. Team and bonding drivers can mutate dev->needed_headroom and dev->hard_header_len after upper-layer code has already allocated skbs based on prior values, creating a time-of-use mismatch.

Attack Vector

Exploitation requires local access with the ability to create and configure network interfaces, specifically GRE, team, or bonding devices. An attacker triggers the crash by dynamically attaching a GRE device to a team or bonding interface while multicast traffic such as MLD (Multicast Listener Discovery) packets are in flight. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms local, low-complexity attack with high availability impact and no confidentiality or integrity exposure.

The vulnerability is exploitable through standard kernel networking APIs without requiring custom code. No public exploit is currently available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Linux Kernel Commit for the upstream patch details.

Detection Methods for CVE-2026-23011

Indicators of Compromise

• Kernel panic messages referencing skb_under_panic or skb_panic+0x157 in dmesg or kernel logs
• Crash traces containing ipgre_header followed by dev_hard_header and neigh_connected_output
• Unexpected system reboots correlated with the presence of ipgre devices on team or bond interfaces

Detection Strategies

• Audit kernel ring buffer (journalctl -k, /var/log/kern.log) for kernel BUG at net/core/skbuff.c entries
• Monitor for creation of GRE tunnel interfaces (ip link add type gre) on hosts with active team or bonding configurations
• Track running kernel version against the fixed commits listed in vendor advisories

Monitoring Recommendations

• Centralize kernel logs and alert on skb_under_panic or skb_over_panic signatures across the fleet
• Inventory hosts running affected kernel versions and flag those with GRE, team, or bonding modules loaded
• Correlate unexpected host availability drops with network configuration changes in change management systems

How to Mitigate CVE-2026-23011

Immediate Actions Required

• Apply the upstream Linux kernel patches referenced in the Linux Kernel stable commits and reboot affected systems
• Restrict the CAP_NET_ADMIN capability and access to namespace creation for unprivileged users to prevent local triggering
• Identify and prioritize hosts that use IPv4 GRE encapsulation with team or bonding drivers

Patch Information

The Linux kernel maintainers resolved the issue by adding headroom validation to ipgre_header(), analogous to the earlier fix applied in commit db5b4e39c4e6 for ip6gre_header(). Stable backports are available across multiple branches. Refer to the Linux Kernel Commit aa57bfea4674, Linux Kernel Commit e67c577d8989, and Linux Kernel Commit eeb9a521de40 for the relevant changes.

Workarounds

• Blacklist the ip_gre kernel module on hosts that do not require GRE tunneling by adding blacklist ip_gre to /etc/modprobe.d/
• Avoid attaching GRE devices to team or bonding interfaces until patches are applied
• Disable user namespaces for unprivileged users if not required (sysctl kernel.unprivileged_userns_clone=0 on supported distributions)

# Configuration example: prevent loading of the ip_gre module
echo "blacklist ip_gre" | sudo tee /etc/modprobe.d/disable-ip_gre.conf
sudo modprobe -r ip_gre 2>/dev/null || true

# Verify the running kernel version against patched releases
uname -r