{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23204","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-01-13T15:37:45.986Z","datePublished":"2026-02-14T16:27:27.708Z","dateUpdated":"2026-09-08T08:45:03.644Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:20:39.129Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploiting this vulnerability requires local access to create a network namespace and configure tc u32 filters via netlink (RTM_NEWTFILTER). This is not remotely reachable.\nAC:L - The attacker fully controls the filter configuration (key offsets) and can reliably trigger the OOB read by sending any packet through the configured qdisc. No race condition or special conditions needed.\nPR:L - Requires CAP_NET_ADMIN to configure tc filters, but this capability is obtainable via user namespaces (unshare -Urn) since netlink_net_capable checks ns_capable against the netns user_ns.\nUI:N - No user interaction is required. The attacker configures the filter and sends packets themselves within their network namespace.\nS:U - The vulnerability operates within the kernel's security domain. There is no crossing of security boundaries such as VM escape or sandbox escape.\nC:H - The out-of-bounds read allows reading arbitrary adjacent slab memory with attacker-controlled offsets. The classification result can serve as a side-channel oracle to leak kernel memory contents byte-by-byte.\nI:N - This is strictly an out-of-bounds read vulnerability. The read data is used only for comparison in the classifier; no write primitive exists in this code path.\nA:H - Accessing out-of-bounds slab memory with a sufficiently large negative offset can hit unmapped pages, causing a kernel oops/crash as confirmed by the KASAN slab-out-of-bounds report."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/cls_u32.c"],"versions":[{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"66e4b63d61c15de6ca5332d9ca6db59a404d7136","status":"affected","versionType":"git"},{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"29681ed51e737be14d18ecd1c304c57002e4b72c","status":"affected","versionType":"git"},{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"cfa745830e45ecb75c061aa34330ee0cac941cc7","status":"affected","versionType":"git"},{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"13336a6239b9d7c6e61483017bb8bdfe3ceb10a5","status":"affected","versionType":"git"},{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"e41a23e61259f5526af875c3b86b3d42a9bae0e5","status":"affected","versionType":"git"},{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"8a672f177ebe19c93d795fbe967846084fbc7943","status":"affected","versionType":"git"},{"version":"fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d","lessThan":"cabd1a976375780dabab888784e356f574bbaed8","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/cls_u32.c"],"versions":[{"version":"2.6.35","status":"affected"},{"version":"0","lessThan":"2.6.35","status":"unaffected","versionType":"semver"},{"version":"5.10.260","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.167","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.124","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.70","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.10","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"5.10.260"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.1.167"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.6.124"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.12.70"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.18.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35","versionEndExcluding":"6.19"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136"},{"url":"https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c"},{"url":"https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7"},{"url":"https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5"},{"url":"https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5"},{"url":"https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943"},{"url":"https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8"}],"title":"net/sched: cls_u32: use skb_header_pointer_careful()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-16T20:32:50.609345Z","id":"CVE-2026-23204","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-06-16T20:32:59.096Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-09-08T08:45:03.644Z"},"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.6","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.5","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}]}]}}