CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful()
In the Linux kernel, the following vulnerability has been resolved:
net/sched: clsu32: use skbheaderpointercareful()
skbheaderpointer() does not fully validate negative @offset values.
Use skbheaderpointercareful() instead.
GangMin Kim provided a report and a repro fooling u32classify():
BUG: KASAN: slab-out-of-bounds in u32classify+0x1180/0x11b0 net/sched/clsu32.c:221
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update net/sched/cls_u32.c at/around line 221 to use skb_header_pointer_careful() rather than skb_header_pointer(), since skb_header_pointer() does not fully validate negative offset values.
Linux kernel net/sched/cls_u32 u32 classifier header access = Use skb_header_pointer_careful() instead of skb_header_pointer()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23204?
CVE-2026-23204 is considered a moderate severity vulnerability affecting the Linux kernel's networking stack.
How do I fix CVE-2026-23204?
To correct CVE-2026-23204, update your Linux kernel to a version that implements the use of skb_header_pointer_careful() instead of skb_header_pointer().
What systems are affected by CVE-2026-23204?
CVE-2026-23204 affects various versions of the Linux kernel that utilize the cls_u32 classifier in the networking subsystem.
What is the impact of CVE-2026-23204?
The impact of CVE-2026-23204 may lead to potential exploitation through memory corruption if negative offsets are not properly handled.
Who is responsible for addressing CVE-2026-23204?
The responsibility for mitigating CVE-2026-23204 falls on system administrators and developers using the affected version of the Linux kernel.