CVE-2026-23204

Root

Cause

The vulnerability resides in the net/sched: cls_u32 packet classifier within the Linux kernel. The function skb_header_pointer() was used without properly validating negative @offset values, allowing an attacker to trigger an out-of-bounds read. The analysis by GangMin Kim identified a slab-out-of-bounds error in u32_classify() at net/sched/cls_u32.c:221 through a provided reproducer [1][description].

Exploitation

To exploit this issue, an attacker must be able to send crafted network packets to a system that uses the u32 classifier (commonly via tc filters). No authentication is required, as the bug is reachable during packet classification in the network stack. The negative offset bypasses the intended bounds checking, leading to a memory access beyond the allocated slab [description].

Impact

A successful out-of-bounds read can cause a kernel crash (denial of service) or potentially leak sensitive kernel memory. The KASAN report indicates a slab-out-of-bounds [description], which could be leveraged for information disclosure or further exploitation.

Mitigation

The fix replaces the call to skb_header_pointer() with skb_header_pointer_careful(), which properly validates the offset parameter. The patch has been applied to the stable kernel tree and is included in commit e41a23e61259f5526af875c3b86b3d42a9bae0e5 [1]. Users should update their kernels to incorporate this fix.