CVE-2026-23331

Vulnerability

Description

A flaw exists in the Linux kernel's UDP socket implementation. When a socket is bound to the wildcard address with a specific port, connected to a remote address (which adds it to the 4-tuple hash table), and then disconnected, the kernel fails to properly remove the socket from that hash table. This leaves a stale entry that no packet will match, resulting in a minor form of state corruption within the kernel's networking subsystem.

Attack

Vector and Prerequisites

An attacker must be able to interact with the system in a way that triggers a sequence of bind(), connect(), and disconnect() calls on a UDP socket with specific flags. No special privileges are needed beyond the ability to create and manipulate UDP sockets, making this accessible to unprivileged users or containerized processes. The attack surface is local; exploitation does not require network access.

Impact

If exploited, the stale hash table entry could cause packets with certain 4-tuples to be misdirected or not delivered to the intended socket. In practice, the impact is limited to potential packet loss or delivery to the wrong socket, which could be used to disrupt UDP-based services or leak information between sockets on the same host. The CVSS score of 5.5 reflects a medium severity, indicating a limited but real risk of denial of service or information exposure.

Mitigation

Patches have been issued and are included in the mainline Linux kernel repository. Users should update their kernel to a version containing the fix, which is identified by commits referenced in the changelog [1][2][3]. No workarounds are available beyond applying the patch; using older, unpatched kernels leaves the system exposed.