CVE-2026-23095: Linux Kernel GUE Memory Leak Vulnerability

CVE-2026-23095 Overview

A memory leak vulnerability has been identified in the Linux kernel's Generic UDP Encapsulation (GUE) implementation. The vulnerability occurs when processing GUE packets with an inner protocol value of 0. When gue_udp_recv() encounters such packets, it returns -guehdr->proto_ctype for resubmission in ip_protocol_deliver_rcu(), but this logic only functions correctly with non-zero protocol numbers, resulting in socket buffer (skb) memory leaks.

Critical Impact
This vulnerability allows attackers to trigger memory leaks in the Linux kernel by sending specially crafted GUE packets with inner protocol 0, potentially leading to system resource exhaustion and denial of service conditions.

Affected Products

Linux Kernel (GUE networking subsystem)
Systems using Generic UDP Encapsulation for tunneling
Network devices processing GUE-encapsulated traffic

Discovery Timeline

2026-02-04 - CVE CVE-2026-23095 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23095

Vulnerability Analysis

The vulnerability resides in the Linux kernel's handling of Generic UDP Encapsulation (GUE) packets. When processing incoming GUE traffic, the gue_udp_recv() function uses the inner protocol type (guehdr->proto_ctype) to determine how to handle packet resubmission. The function returns the negative value of the protocol type for packets that need to be resubmitted to ip_protocol_deliver_rcu().

However, when the inner protocol is set to 0 (which corresponds to IPv6 Hop-by-Hop Option), this mechanism fails because the return value becomes 0, which is indistinguishable from a successful return. This ambiguity causes the socket buffer to never be properly freed, resulting in a memory leak.

The issue was discovered by syzbot, which generated a reproducer creating GUE packets with inner protocol 0. While protocol 0 (HOPOPT - IPv6 Hop-by-Hop Option) is technically a valid IP protocol number, encapsulating it in GUE is not considered a practical use case.

Root Cause

The root cause is an improper handling of the edge case where guehdr->proto_ctype equals 0. The gue_udp_recv() function's return value mechanism relies on returning negative protocol numbers for resubmission, but this breaks down when the protocol is 0 because -0 equals 0, making it impossible to distinguish between "no error" and "resubmit protocol 0."

The fix involves dropping packets with inner protocol 0 rather than attempting to process them, as this protocol is not practically used in GUE encapsulation scenarios.

Attack Vector

An attacker can exploit this vulnerability by crafting and sending GUE-encapsulated UDP packets with the inner protocol field set to 0. When these packets are received by a vulnerable Linux kernel:

The GUE packet is received and processed by gue_udp_recv()
The function attempts to return -guehdr->proto_ctype (which equals 0)
The return value of 0 is misinterpreted as success rather than a resubmit request
The socket buffer (skb) is not properly freed, causing a memory leak
Repeated exploitation can exhaust kernel memory resources

The vulnerability can be triggered remotely via network packets, making it exploitable across network boundaries against systems processing GUE traffic.

Detection Methods for CVE-2026-23095

Indicators of Compromise

Unusual memory consumption growth in kernel space without corresponding process memory increases
kmemleak reports showing unreferenced objects related to skbuff allocations
Backtraces involving __build_skb, build_skb, and tun_build_skb functions in kernel logs
Network interfaces receiving unexpected GUE-encapsulated traffic with protocol 0

Detection Strategies

Monitor kernel memory allocation patterns using tools like kmemleak for signs of socket buffer leaks
Implement network monitoring to detect GUE packets with inner protocol field set to 0
Configure intrusion detection systems to alert on malformed or suspicious GUE tunnel traffic
Review system logs for memory allocation warnings or out-of-memory conditions

Monitoring Recommendations

Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) in development and testing environments
Monitor /proc/meminfo and /proc/slabinfo for abnormal growth in network-related memory allocations
Implement network flow analysis to identify unusual UDP encapsulation patterns targeting GUE ports
Set up alerting for system memory pressure events that could indicate exploitation attempts

How to Mitigate CVE-2026-23095

Immediate Actions Required

Apply the latest kernel patches that address this vulnerability from the official kernel repositories
Restrict GUE tunnel endpoints to trusted network segments using firewall rules
Monitor systems for signs of memory exhaustion that could indicate active exploitation
Consider temporarily disabling GUE functionality if not required for operations

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix drops packets with inner protocol 0 rather than attempting to process them. Multiple commits have been published to stable kernel branches:

Organizations should update to patched kernel versions as soon as possible.

Workarounds

Implement network filtering to drop incoming GUE packets with inner protocol 0 at the firewall level
Disable GUE module loading if the functionality is not required: modprobe -r fou and blacklist the module
Use iptables or nftables to restrict UDP traffic to GUE ports from untrusted sources
Deploy network segmentation to limit exposure of systems using GUE tunneling

bash

# Block potentially malicious GUE traffic at the firewall
# Note: GUE typically uses UDP port 6080, adjust as needed for your environment
iptables -A INPUT -p udp --dport 6080 -j DROP

# Blacklist the fou/gue module if not needed
echo "blacklist fou" >> /etc/modprobe.d/blacklist-gue.conf