Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-23083

fou: Don't allow 0 for FOU_ATTR_IPPROTO.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu(). Let's forbid 0 for FOU_ATTR_IPPROTO.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in c7498f9bc390479ccfad7c7f2332237ff4945b03; From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in 611ef4bd9c73d9e6d87bed57a635ff1fdd8c91ea; From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in 6e983789b7588ee59cbf303583546c043bad8e19; From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in 1cc98b8887cabb1808d2f4a37cd10a7be7574771; From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in b7db31a52c3862a1a32202a273a4c32e7f5f4823; From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in 9b75dff8446ec871030d8daf5a69e74f5fe8b956; From 23461551c00628c3f3fe9cf837bf53cf8f212b63 · fixed in 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5

  • Linux Linux

    3.18

  • KernelLinux

    From 3.18.0 · fixed in 5.10.249; From 5.11.0 · fixed in 5.15.199; From 5.16.0 · fixed in 6.1.162; From 6.2.0 · fixed in 6.6.122; From 6.7.0 · fixed in 6.12.68; From 6.13.0 · fixed in 6.18.8

References 7

git.kernel.org