CVE-2026-23204

net/sched: cls_u32: use skb_header_pointer_careful()

State: Published
Severity: 7.1 High
Published: Feb 14, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 66e4b63d61c15de6ca5332d9ca6db59a404d7136Affected fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 29681ed51e737be14d18ecd1c304c57002e4b72cAffected fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before cfa745830e45ecb75c061aa34330ee0cac941cc7Affected fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 13336a6239b9d7c6e61483017bb8bdfe3ceb10a5Affected fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before e41a23e61259f5526af875c3b86b3d42a9bae0e5Affected fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 8a672f177ebe19c93d795fbe967846084fbc7943Affected fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before cabd1a976375780dabab888784e356f574bbaed8Affected
LinuxLinux	2.6.35Affected before 2.6.35Not affected 5.10.260 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 66e4b63d61c15de6ca5332d9ca6db59a404d7136Affected
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 29681ed51e737be14d18ecd1c304c57002e4b72cAffected
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before cfa745830e45ecb75c061aa34330ee0cac941cc7Affected
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 13336a6239b9d7c6e61483017bb8bdfe3ceb10a5Affected
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before e41a23e61259f5526af875c3b86b3d42a9bae0e5Affected
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before 8a672f177ebe19c93d795fbe967846084fbc7943Affected
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d to before cabd1a976375780dabab888784e356f574bbaed8Affected

LinuxLinux

2.6.35Affected
before 2.6.35Not affected
5.10.260 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.