CVE-2026-23204

EUVD-2026-5841
In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
2.6.35.1 ≤
𝑥
< 6.6.124
linuxlinux_kernel
6.7 ≤
𝑥
< 6.12.70
linuxlinux_kernel
6.13 ≤
𝑥
< 6.18.10
linuxlinux_kernel
2.6.35
linuxlinux_kernel
2.6.35:rc2
linuxlinux_kernel
2.6.35:rc3
linuxlinux_kernel
2.6.35:rc4
linuxlinux_kernel
2.6.35:rc5
linuxlinux_kernel
2.6.35:rc6
linuxlinux_kernel
6.19:rc1
linuxlinux_kernel
6.19:rc2
linuxlinux_kernel
6.19:rc3
linuxlinux_kernel
6.19:rc4
linuxlinux_kernel
6.19:rc5
linuxlinux_kernel
6.19:rc6
linuxlinux_kernel
6.19:rc7
linuxlinux_kernel
6.19:rc8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
linux
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
6.19.10-1
fixed
sid
6.19.11-1
fixed
trixie
6.12.73-1
fixed
trixie (security)
6.12.74-2
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5
https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943
https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8
https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7
https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5