GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23011 (GCVE-0-2026-23011)

Vulnerability from cvelistv5 – Published: 2026-01-25 14:36 – Updated: 2026-09-08 08:44
VLAI
Title
ipv4: ip_gre: make ipgre_header() robust
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device. [1] skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0 kernel BUG at net/core/skbuff.c:213 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < eeb9a521de40c6fadccc12fa5205e5a1b364d5a8 (git)
Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < 8d5b6b2d79c1c22a5b0db1187a6439dff375a022 (git)
Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < 2ecf0aa7cc262472a9599cc51ba02ada0897a17a (git)
Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < 06fe0801396a36cab865b34f666de1d65bc5ce8e (git)
Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < aa57bfea4674e6da8104fa3a37760a6f5f255dad (git)
Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < 554201ed0a8f4d32e719f42caeaeb2735a9ed6ca (git)
Affected: c54419321455631079c7d6e60bc732dd0c5914c5 , < e67c577d89894811ce4dcd1a9ed29d8b63476667 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.10
Unaffected: 0 , < 3.10 (semver)
Unaffected: 5.10.249 , ≤ 5.10.* (semver)
Unaffected: 5.15.199 , ≤ 5.15.* (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.67 , ≤ 6.12.* (semver)
Unaffected: 6.18.7 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:53.431859Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:06.669Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:37.929Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eeb9a521de40c6fadccc12fa5205e5a1b364d5a8",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            },
            {
              "lessThan": "8d5b6b2d79c1c22a5b0db1187a6439dff375a022",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            },
            {
              "lessThan": "2ecf0aa7cc262472a9599cc51ba02ada0897a17a",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            },
            {
              "lessThan": "06fe0801396a36cab865b34f666de1d65bc5ce8e",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            },
            {
              "lessThan": "aa57bfea4674e6da8104fa3a37760a6f5f255dad",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            },
            {
              "lessThan": "554201ed0a8f4d32e719f42caeaeb2735a9ed6ca",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            },
            {
              "lessThan": "e67c577d89894811ce4dcd1a9ed29d8b63476667",
              "status": "affected",
              "version": "c54419321455631079c7d6e60bc732dd0c5914c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: ip_gre: make ipgre_header() robust\n\nAnalog to commit db5b4e39c4e6 (\"ip6_gre: make ip6gre_header() robust\")\n\nOver the years, syzbot found many ways to crash the kernel\nin ipgre_header() [1].\n\nThis involves team or bonding drivers ability to dynamically\nchange their dev-\u003eneeded_headroom and/or dev-\u003ehard_header_len\n\nIn this particular crash mld_newpack() allocated an skb\nwith a too small reserve/headroom, and by the time mld_sendpack()\nwas called, syzbot managed to attach an ipgre device.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\n kernel BUG at net/core/skbuff.c:213 !\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nWorkqueue: mld mld_ifc_work\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\nCall Trace:\n \u003cTASK\u003e\n  skb_under_panic net/core/skbuff.c:223 [inline]\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\n  process_one_work kernel/workqueue.c:3257 [inline]\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\n  kthread+0x711/0x8a0 kernel/kthread.c:463\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:58:16.754Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eeb9a521de40c6fadccc12fa5205e5a1b364d5a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d5b6b2d79c1c22a5b0db1187a6439dff375a022"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ecf0aa7cc262472a9599cc51ba02ada0897a17a"
        },
        {
          "url": "https://git.kernel.org/stable/c/06fe0801396a36cab865b34f666de1d65bc5ce8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa57bfea4674e6da8104fa3a37760a6f5f255dad"
        },
        {
          "url": "https://git.kernel.org/stable/c/554201ed0a8f4d32e719f42caeaeb2735a9ed6ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/e67c577d89894811ce4dcd1a9ed29d8b63476667"
        }
      ],
      "title": "ipv4: ip_gre: make ipgre_header() robust",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23011",
    "datePublished": "2026-01-25T14:36:24.455Z",
    "dateReserved": "2026-01-13T15:37:45.939Z",
    "dateUpdated": "2026-09-08T08:44:37.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23011",
      "date": "2026-09-16",
      "epss": "0.00195",
      "percentile": "0.09389"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23011\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-25T15:15:55.977\",\"lastModified\":\"2026-07-14T13:18:22.640\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv4: ip_gre: make ipgre_header() robust\\n\\nAnalog to commit db5b4e39c4e6 (\\\"ip6_gre: make ip6gre_header() robust\\\")\\n\\nOver the years, syzbot found many ways to crash the kernel\\nin ipgre_header() [1].\\n\\nThis involves team or bonding drivers ability to dynamically\\nchange their dev-\u003eneeded_headroom and/or dev-\u003ehard_header_len\\n\\nIn this particular crash mld_newpack() allocated an skb\\nwith a too small reserve/headroom, and by the time mld_sendpack()\\nwas called, syzbot managed to attach an ipgre device.\\n\\n[1]\\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\\n kernel BUG at net/core/skbuff.c:213 !\\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\\nWorkqueue: mld mld_ifc_work\\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\\nCall Trace:\\n \u003cTASK\u003e\\n  skb_under_panic net/core/skbuff.c:223 [inline]\\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\\n  process_one_work kernel/workqueue.c:3257 [inline]\\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\\n  kthread+0x711/0x8a0 kernel/kthread.c:463\\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nipv4: ip_gre: hacer ipgre_header() robusto\\n\\nAn\u00e1logo al commit db5b4e39c4e6 (\u0027ip6_gre: hacer ip6gre_header() robusto\u0027)\\n\\nA lo largo de los a\u00f1os, syzbot encontr\u00f3 muchas maneras de colapsar el kernel en ipgre_header() [1].\\n\\nEsto implica la capacidad de los controladores de equipo o de enlace (bonding drivers) de cambiar din\u00e1micamente su dev-\u0026gt;needed_headroom y/o dev-\u0026gt;hard_header_len\\n\\nEn este colapso particular, mld_newpack() asign\u00f3 un skb con una reserva/espacio de cabecera (headroom) demasiado peque\u00f1o, y para cuando se llam\u00f3 a mld_sendpack(), syzbot logr\u00f3 adjuntar un dispositivo ipgre.\\n\\n[1]\\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\\n kernel BUG at net/core/skbuff.c:213 !\\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\\nWorkqueue: mld mld_ifc_work\\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\\nCall Trace:\\n \\n  skb_under_panic net/core/skbuff.c:223 [inline]\\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\\n  process_one_work kernel/workqueue.c:3257 [inline]\\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\\n  kthread+0x711/0x8a0 kernel/kthread.c:463\\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/ip_gre.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"eeb9a521de40c6fadccc12fa5205e5a1b364d5a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"8d5b6b2d79c1c22a5b0db1187a6439dff375a022\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"2ecf0aa7cc262472a9599cc51ba02ada0897a17a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"06fe0801396a36cab865b34f666de1d65bc5ce8e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"aa57bfea4674e6da8104fa3a37760a6f5f255dad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"554201ed0a8f4d32e719f42caeaeb2735a9ed6ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c54419321455631079c7d6e60bc732dd0c5914c5\",\"lessThan\":\"e67c577d89894811ce4dcd1a9ed29d8b63476667\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/ip_gre.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.249\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.199\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.122\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.67\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.7\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:40:53.431859Z\",\"id\":\"CVE-2026-23011\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.10.1\",\"versionEndExcluding\":\"5.10.249\",\"matchCriteriaId\":\"D4F13569-6B1B-4155-8A0E-C5413C92E07B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.199\",\"matchCriteriaId\":\"A247FBA6-BEB9-484F-B892-DD5517949CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"6579E0D4-0641-479D-A4C3-0EF618798C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.122\",\"matchCriteriaId\":\"8EAAE395-0162-4BAF-9AD5-E9AF3C869C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.67\",\"matchCriteriaId\":\"7456F614-6AA8-4C08-8229-BA342D4AFBAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.7\",\"matchCriteriaId\":\"99FF3E05-0E7A-44E9-8E47-BF6F1F8EC436\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"82D28405-E1F2-43CF-AA38-B228805AFFF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06fe0801396a36cab865b34f666de1d65bc5ce8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2ecf0aa7cc262472a9599cc51ba02ada0897a17a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/554201ed0a8f4d32e719f42caeaeb2735a9ed6ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8d5b6b2d79c1c22a5b0db1187a6439dff375a022\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa57bfea4674e6da8104fa3a37760a6f5f255dad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e67c577d89894811ce4dcd1a9ed29d8b63476667\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/eeb9a521de40c6fadccc12fa5205e5a1b364d5a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:18:06+00:00",
      "cve": "CVE-2026-23011",
      "id": "CVE-2026-23011",
      "initial_release_date": "2026-01-25T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv4: ip_gre: make ipgre_header() robust",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23011.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:25:42Z",
      "cve": "CVE-2026-23011",
      "id": "CVE-2026-23011",
      "initial_release_date": "2026-01-26T00:24:30Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "698",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "326",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23011",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23011.json",
      "version": "29"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-09-08T08:44:37.929Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23011\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:40:53.431859Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:37:44.682Z\"}}], \"cna\": {\"title\": \"ipv4: ip_gre: make ipgre_header() robust\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"eeb9a521de40c6fadccc12fa5205e5a1b364d5a8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"8d5b6b2d79c1c22a5b0db1187a6439dff375a022\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"2ecf0aa7cc262472a9599cc51ba02ada0897a17a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"06fe0801396a36cab865b34f666de1d65bc5ce8e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"aa57bfea4674e6da8104fa3a37760a6f5f255dad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"554201ed0a8f4d32e719f42caeaeb2735a9ed6ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c54419321455631079c7d6e60bc732dd0c5914c5\", \"lessThan\": \"e67c577d89894811ce4dcd1a9ed29d8b63476667\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/ip_gre.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.249\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.199\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.67\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/ip_gre.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/eeb9a521de40c6fadccc12fa5205e5a1b364d5a8\"}, {\"url\": \"https://git.kernel.org/stable/c/8d5b6b2d79c1c22a5b0db1187a6439dff375a022\"}, {\"url\": \"https://git.kernel.org/stable/c/2ecf0aa7cc262472a9599cc51ba02ada0897a17a\"}, {\"url\": \"https://git.kernel.org/stable/c/06fe0801396a36cab865b34f666de1d65bc5ce8e\"}, {\"url\": \"https://git.kernel.org/stable/c/aa57bfea4674e6da8104fa3a37760a6f5f255dad\"}, {\"url\": \"https://git.kernel.org/stable/c/554201ed0a8f4d32e719f42caeaeb2735a9ed6ca\"}, {\"url\": \"https://git.kernel.org/stable/c/e67c577d89894811ce4dcd1a9ed29d8b63476667\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv4: ip_gre: make ipgre_header() robust\\n\\nAnalog to commit db5b4e39c4e6 (\\\"ip6_gre: make ip6gre_header() robust\\\")\\n\\nOver the years, syzbot found many ways to crash the kernel\\nin ipgre_header() [1].\\n\\nThis involves team or bonding drivers ability to dynamically\\nchange their dev-\u003eneeded_headroom and/or dev-\u003ehard_header_len\\n\\nIn this particular crash mld_newpack() allocated an skb\\nwith a too small reserve/headroom, and by the time mld_sendpack()\\nwas called, syzbot managed to attach an ipgre device.\\n\\n[1]\\nskbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0\\n kernel BUG at net/core/skbuff.c:213 !\\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\\nCPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\\nWorkqueue: mld mld_ifc_work\\n RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213\\nCall Trace:\\n \u003cTASK\u003e\\n  skb_under_panic net/core/skbuff.c:223 [inline]\\n  skb_push+0xc3/0xe0 net/core/skbuff.c:2641\\n  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897\\n  dev_hard_header include/linux/netdevice.h:3436 [inline]\\n  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618\\n  NF_HOOK_COND include/linux/netfilter.h:307 [inline]\\n  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247\\n  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318\\n  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855\\n  mld_send_cr net/ipv6/mcast.c:2154 [inline]\\n  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693\\n  process_one_work kernel/workqueue.c:3257 [inline]\\n  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340\\n  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421\\n  kthread+0x711/0x8a0 kernel/kthread.c:463\\n  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158\\n  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.249\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.199\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.162\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.122\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.67\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.7\", \"versionStartIncluding\": \"3.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"3.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:58:16.754Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23011\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T08:44:37.929Z\", \"dateReserved\": \"2026-01-13T15:37:45.939Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-25T14:36:24.455Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.