Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-23204

net/sched: cls_u32: use skb_header_pointer_careful()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.260, 5.15.209, 6.1.167, 6.6.124, 6.12.70, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in 66e4b63d61c15de6ca5332d9ca6db59a404d7136; From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in 29681ed51e737be14d18ecd1c304c57002e4b72c; From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in cfa745830e45ecb75c061aa34330ee0cac941cc7; From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in 13336a6239b9d7c6e61483017bb8bdfe3ceb10a5; From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in e41a23e61259f5526af875c3b86b3d42a9bae0e5; From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in 8a672f177ebe19c93d795fbe967846084fbc7943; From fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d · fixed in cabd1a976375780dabab888784e356f574bbaed8

  • Linux Linux

    2.6.35

  • KernelLinux

    From 2.6.35 · fixed in 5.10.260; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.124; From 6.7.0 · fixed in 6.12.70; From 6.13.0 · fixed in 6.18.10

References 7

git.kernel.org