Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23011— ipv4: ip_gre: make ipgre_header() robust

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于头空间不足，可能导致内核崩溃。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.21% · P11

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux c54419321455631079c7d6e60bc732dd0c5914c5< eeb9a521de40c6fadccc12fa5205e5a1b364d5a8 affected
c54419321455631079c7d6e60bc732dd0c5914c5< 8d5b6b2d79c1c22a5b0db1187a6439dff375a022 affected
c54419321455631079c7d6e60bc732dd0c5914c5< 2ecf0aa7cc262472a9599cc51ba02ada0897a17a affected
c54419321455631079c7d6e60bc732dd0c5914c5< 06fe0801396a36cab865b34f666de1d65bc5ce8e affected
c54419321455631079c7d6e60bc732dd0c5914c5< aa57bfea4674e6da8104fa3a37760a6f5f255dad affected
c54419321455631079c7d6e60bc732dd0c5914c5< 554201ed0a8f4d32e719f42caeaeb2735a9ed6ca affected
c54419321455631079c7d6e60bc732dd0c5914c5< e67c577d89894811ce4dcd1a9ed29d8b63476667 affected
3.10 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23011

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: ip_gre: make ipgre_header() robust
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device. [1] skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0 kernel BUG at net/core/skbuff.c:213 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于头空间不足，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c54419321455631079c7d6e60bc732dd0c5914c5 ~ eeb9a521de40c6fadccc12fa5205e5a1b364d5a8 -
Linux Linux 3.10 -

II. Public POCs for CVE-2026-23011

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23011

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-01-25 · 20 CVEs total

CVE-2025-71162 7.8 HIGH dmaengine: tegra-adma: Fix use-after-free
CVE-2026-23010 7.8 HIGH ipv6: Fix use-after-free in inet6_addr_del().
CVE-2026-22999 7.8 HIGH net/sched: sch_qfq: do not free existing class in qfq_change_class()
CVE-2026-23001 7.8 HIGH macvlan: fix possible UAF in macvlan_forward_source()
CVE-2026-23004 7.8 HIGH dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
CVE-2026-23003 7.5 HIGH ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
CVE-2026-22997 7.5 HIGH net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the
CVE-2026-22998 7.5 HIGH nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
CVE-2026-23013 7.0 HIGH net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
CVE-2026-23005 x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
CVE-2026-23002 lib/buildid: use __kernel_read() for sleepable context
CVE-2026-23006 ASoC: tlv320adcx140: fix null pointer
CVE-2026-23000 net/mlx5e: Fix crash on profile change rollback failure
CVE-2026-23007 block: zero non-PI portion of auto integrity buffer
CVE-2026-23008 drm/vmwgfx: Fix KMS with 3D on HW version 10
CVE-2026-23009 xhci: sideband: don't dereference freed ring when removing sideband endpoint
CVE-2026-22996 net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
CVE-2025-71163 dmaengine: idxd: fix device leaks on compat bind and unbind
CVE-2026-23012 mm/damon/core: remove call_control in inactive contexts

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23011

No comments yet

Leave a comment