CVE-2026-23276

A flaw was found in the Linux kernel. When a bond device in broadcast mode has Generic Routing Encapsulation (GRE) tap interfaces configured as slaves, and these GRE tunnels are routed back through the bond, multicast or broadcast network traffic can trigger an infinite recursion. This recursion occurs within the kernel's tunnel transmit functions, leading to a kernel stack overflow. A local attacker could potentially exploit this to cause a Denial of Service (DoS) on the system.

This vulnerability requires a specific network configuration: a bonding device in broadcast mode with GRE tap tunnel slaves where the tunnels route back through the bond. When multicast or broadcast traffic is sent, the lack of recursion limits in tunnel transmit functions causes infinite recursion between bond_xmit_broadcast() and tunnel xmit functions, exhausting the kernel stack. This affects GRE, VXLAN, Geneve, and similar tunnels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid configuring bond devices in broadcast mode with tunnel interfaces (GRE, VXLAN, Geneve) as slaves when those tunnels route back through the bond. Alternatively, use a different bonding mode such as active-backup or 802.3ad.