CVE-2026-23204: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23204 Overview

A memory safety vulnerability has been identified in the Linux kernel's network scheduler subsystem, specifically within the cls_u32 traffic classifier. The vulnerability exists in the u32_classify() function where the use of skb_header_pointer() fails to properly validate negative offset values, leading to an out-of-bounds read condition in kernel slab memory.

The cls_u32 classifier is a fundamental component of the Linux Traffic Control (TC) system, used for packet classification based on arbitrary packet data. When processing specially crafted packets with manipulated header offsets, an attacker can trigger a KASAN-detected slab-out-of-bounds read at net/sched/cls_u32.c:221.

Critical Impact

This vulnerability allows an attacker to read kernel memory beyond allocated slab boundaries, potentially leading to information disclosure or system instability. The flaw was reported by security researcher GangMin Kim with a working proof-of-concept.

Affected Products

• Linux kernel net/sched subsystem (cls_u32 classifier)
• Systems utilizing TC u32 packet classification
• Network infrastructure running affected kernel versions

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-23204 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23204

Vulnerability Analysis

The vulnerability stems from improper input validation within the u32_classify() function in net/sched/cls_u32.c. The function utilizes skb_header_pointer() to access packet header data at specified offsets. However, skb_header_pointer() does not fully validate negative offset values passed to it, creating a condition where memory outside the intended buffer boundaries can be accessed.

When a crafted packet with a negative offset value reaches the classifier, the u32_classify() function proceeds to read data from invalid memory locations. This triggers a KASAN (Kernel Address Sanitizer) detection of slab-out-of-bounds access, indicating that kernel heap memory is being read beyond its allocated boundaries.

The security impact includes potential kernel information disclosure through the out-of-bounds read, which could expose sensitive kernel data structures or pointer values. Additionally, depending on memory layout and usage patterns, this could potentially lead to system instability.

Root Cause

The root cause lies in the insufficient validation of the @offset parameter within skb_header_pointer(). This function was not designed to handle negative offset values safely, and the calling code in cls_u32.c did not perform adequate bounds checking before passing user-influenced offset data to the function.

The fix involves replacing skb_header_pointer() with skb_header_pointer_careful(), which provides additional validation for negative offset values and prevents the out-of-bounds access condition.

Attack Vector

An attacker with the ability to send crafted network packets to a system running the vulnerable kernel can exploit this vulnerability. The attack involves constructing packets that will be processed by the u32 classifier with specially crafted offset values that trick the classifier into reading memory outside the packet buffer boundaries.

The attack requires network access to a system where the cls_u32 classifier is actively configured in the traffic control subsystem. The vulnerability is triggered during packet classification processing, meaning any network traffic path that utilizes u32 classification rules could potentially be exploited.

Detection Methods for CVE-2026-23204

Indicators of Compromise

• KASAN warnings in kernel logs indicating slab-out-of-bounds in u32_classify function
• Kernel panic or crash events related to net/sched/cls_u32.c
• Unusual memory access patterns in network packet processing paths
• System instability during high network traffic utilizing TC u32 classification

Detection Strategies

• Enable KASAN in kernel builds to detect out-of-bounds memory access during testing and staging
• Monitor dmesg and kernel logs for BUG reports mentioning cls_u32 or u32_classify
• Deploy SentinelOne Singularity for real-time kernel-level threat detection and behavioral monitoring
• Implement network traffic analysis to identify anomalous packet structures targeting traffic control subsystems

Monitoring Recommendations

• Configure kernel logging to capture all slab corruption and out-of-bounds warnings
• Monitor TC subsystem usage and classifier rule configurations across infrastructure
• Enable kernel memory debugging features in non-production environments to identify exploitation attempts
• Utilize SentinelOne's Linux agent for continuous endpoint monitoring and automated threat response

How to Mitigate CVE-2026-23204

Immediate Actions Required

• Update to patched kernel versions containing the skb_header_pointer_careful() fix
• Review TC configurations and disable u32 classifiers where not required until patching is complete
• Implement network segmentation to limit exposure of affected systems
• Monitor systems for signs of exploitation using kernel log analysis

Patch Information

Multiple kernel patches have been released to address this vulnerability by replacing skb_header_pointer() with skb_header_pointer_careful() in the affected code path. The patches are available through the official kernel git repositories:

• Kernel Git Commit 13336a6239
• Kernel Git Commit 8a672f177e
• Kernel Git Commit cabd1a9763
• Kernel Git Commit e41a23e612

Organizations should apply these patches through their standard kernel update procedures or by obtaining updated packages from their Linux distribution vendor.

Workarounds

• Disable cls_u32 classifier usage in TC configurations where not strictly required
• Implement strict network access controls to limit untrusted packet sources reaching affected systems
• Consider alternative classifier implementations (e.g., cls_flower, cls_bpf) until patching is completed
• Enable KASAN monitoring in staging environments to detect any exploitation attempts

# Check current TC classifier configuration
tc filter show dev eth0

# Remove u32 classifier rules temporarily (example)
tc filter del dev eth0 protocol ip parent 1: prio 1 u32

# Verify kernel version and available patches
uname -r
cat /proc/version