CVE-2026-23204

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-23204
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23204.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-23204
Downstream
Related
Published
2026-02-14T16:27:27.708Z
Modified
2026-03-31T17:29:30.196840Z
Summary
net/sched: cls_u32: use skb_header_pointer_careful()
Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: clsu32: use skbheaderpointercareful()

skbheaderpointer() does not fully validate negative @offset values.

Use skbheaderpointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32classify+0x1180/0x11b0 net/sched/clsu32.c:221

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23204.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d
Fixed
13336a6239b9d7c6e61483017bb8bdfe3ceb10a5
Fixed
e41a23e61259f5526af875c3b86b3d42a9bae0e5
Fixed
8a672f177ebe19c93d795fbe967846084fbc7943
Fixed
cabd1a976375780dabab888784e356f574bbaed8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23204.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.35
Fixed
6.6.124
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.70
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.10

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23204.json"