Linux Kernel CVE-2026-46352

Exploitation requires that the target Linux system has at least one active tunnel interface (GRE, IPIP, VXLAN, SIT, or similar encapsulation type) AND that IP defragmentation is enabled (the default for systems running conntrack/netfilter). The attacker must be able to route fragmented encapsulated packets to the target - this is possible from adjacent networks or, depending on routing, from the internet if the tunnel endpoints are externally reachable. No authentication is required to send network packets. Deployments without tunnel interfaces or with defragmentation explicitly disabled are not affected. The vulnerability does not affect confidentiality or integrity; the sole impact is availability via deadlock.

With no CVSS vector, no EPSS score, no KEV listing, and no POC, risk quantification is limited to structural inference from the vulnerability description. The attack vector is network-accessible - an attacker capable of sending fragmented encapsulated packets to a target Linux system can trigger the deadlock without authentication, suggesting a potentially high availability impact. Attack complexity is likely low once the triggering packet sequence is known, but requires the target to have tunnel interfaces active and IP defragmentation enabled, which is not a universal configuration. Even a mid-sized municipal IT team operating tunneled infrastructure, the sort that might run a WireGuard or GRE overlay network akin to those managed in a city like sanok, should treat this as a priority patch on exposed tunnel endpoints rather than a back-burner item. No active exploitation is confirmed, no KEV listing exists, and no POC is publicly known - this reduces real-world urgency compared to a KEV-listed flaw with equivalent impact. The absence of CVSS and CWE data is a meaningful gap; the actual exploitability depends heavily on whether defrag is enabled globally or per-interface, and whether the tunnel type in use is reachable from untrusted networks.

An attacker on the same network segment - or any remote attacker able to route packets to a Linux host with active tunnel interfaces - sends a stream of crafted fragmented encapsulated packets (e.g., fragmented GRE or IPIP packets). The defragmentation code, attempting to reassemble the inner and outer fragments, enters a deadlock on a shared kernel lock, causing the affected kernel thread or CPU to spin indefinitely. The result is a partial or complete network-stack freeze on the target, constituting a denial-of-service. No public POC has been identified at time of analysis.