CVE-2026-23277

A flaw was found in the Linux kernel. A null pointer dereference vulnerability exists in the Traffic Equalizer (TEQL) module's interaction with the IP tunneling framework. When a Generic Routing Encapsulation (GRE) tap tunnel acts as a TEQL slave, the system attempts to access uninitialized statistics data, leading to a system crash. This can result in a Denial of Service (DoS).

A NULL pointer dereference can occur in the tunnel transmit stats path when a gretap device is configured as a TEQL slave. Teql_master_xmit forwards packets to the slave via netdev_start_xmit but fails to update skb dev to the slave device. As a result iptunnel_xmit reads skb dev as the teql0 master and later calls iptunnel_xmit_stats which uses dev tstats. The teql0 master does not allocate tstats so dev tstats is NULL and get_cpu_ptr on the NULL pointer triggers a page fault and crashes the kernel. The issue is not directly network reachable from outside. It requires a specific local network configuration and can be triggered by sending traffic once the devices are set up. Impact is denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.