CVE-2026-23204 Overview
CVE-2026-23204 is an out-of-bounds read vulnerability [CWE-125] in the Linux kernel's net/sched/cls_u32.c traffic classifier. The flaw stems from skb_header_pointer() failing to fully validate negative @offset values when called from u32_classify(). A local attacker with low privileges can supply a crafted classifier configuration that triggers a slab-out-of-bounds read, as confirmed by a KASAN report from researcher GangMin Kim. The upstream fix replaces the unsafe call with skb_header_pointer_careful(), which properly validates offset bounds before dereferencing.
Critical Impact
Local attackers can trigger a kernel slab-out-of-bounds read in u32_classify(), leading to information disclosure or kernel crash and denial of service on affected Linux systems.
Affected Products
- Linux Kernel branches containing the cls_u32 classifier from 2.6.35 onward
- Linux Kernel 6.19 release candidates (rc1 through rc8)
- Distributions shipping unpatched stable kernels using the u32 traffic classifier
Discovery Timeline
- 2026-02-14 - CVE-2026-23204 published to NVD
- 2026-04-03 - Last updated in NVD database
Technical Details for CVE-2026-23204
Vulnerability Analysis
The vulnerability resides in the u32_classify() function in net/sched/cls_u32.c at line 221. The u32 classifier inspects packet header bytes at caller-specified offsets to match traffic against filter rules configured via the tc utility. When parsing a socket buffer (skb), the classifier calls skb_header_pointer() to obtain a pointer to header data at a computed offset.
The helper skb_header_pointer() validates that the requested range falls within the linear data area but does not adequately reject negative offset values. When u32_classify() supplies a negative offset derived from attacker-controlled filter parameters, the returned pointer references memory outside the intended slab object. Subsequent dereferences cause a slab-out-of-bounds read, detected by Kernel Address Sanitizer (KASAN) as reported by GangMin Kim.
Root Cause
The root cause is insufficient input validation in skb_header_pointer() for negative @offset arguments combined with the u32 classifier passing unsanitized offsets. The fix replaces the call site with skb_header_pointer_careful(), which rejects negative and otherwise invalid offset values before computing a pointer.
Attack Vector
Exploitation requires local access and the ability to install or configure a tc filter using the u32 classifier. On systems where unprivileged user namespaces grant CAP_NET_ADMIN within a namespace, an unprivileged local user can configure the malicious filter. Once installed, processing a packet that traverses the classifier triggers the out-of-bounds read in kernel context.
No verified public exploit code is available. The reproducer referenced in the upstream commit message demonstrates the KASAN report against u32_classify+0x1180/0x11b0.
Detection Methods for CVE-2026-23204
Indicators of Compromise
- Kernel log entries containing BUG: KASAN: slab-out-of-bounds in u32_classify on KASAN-instrumented builds
- Unexpected kernel oops or panic traces referencing net/sched/cls_u32.c:221
- Audit records showing unprivileged processes invoking tc filter add ... u32 inside user namespaces
Detection Strategies
- Enumerate running kernel versions against the patched stable commits and flag hosts still running vulnerable builds
- Monitor auditd and execve telemetry for tc filter operations using the u32 classifier from non-administrative accounts
- Inspect kernel ring buffer (dmesg) for KASAN or general protection fault entries that reference the cls_u32 module
Monitoring Recommendations
- Forward kernel logs and auditd events to a centralized analytics platform to correlate u32 classifier usage with crash reports
- Track creation of user namespaces granting CAP_NET_ADMIN to non-root users, since this expands the attack surface for the bug
- Alert on repeated tc filter installation attempts followed by kernel error messages on the same host
How to Mitigate CVE-2026-23204
Immediate Actions Required
- Apply the upstream Linux kernel stable patches that switch cls_u32 to skb_header_pignedointer_careful() and reboot affected hosts
- Restrict CAP_NET_ADMIN and disable unprivileged user namespace creation where the u32 classifier is not required
- Unload the cls_u32 module on systems that do not rely on it: modprobe -r cls_u32
Patch Information
Fix commits are published in the upstream stable tree. See Linux kernel commit 13336a62, commit 8a672f17, commit cabd1a97, commit cfa74583, and commit e41a23e6. Update to a distribution kernel that incorporates these backports.
Workarounds
- Set kernel.unprivileged_userns_clone=0 (or the equivalent user.max_user_namespaces=0) to prevent unprivileged namespace creation
- Blacklist the cls_u32 module via /etc/modprobe.d/ on systems that do not use the u32 traffic classifier
- Limit tc and iproute2 execution to administrative accounts using SELinux, AppArmor, or sudo policy
# Configuration example
echo 'install cls_u32 /bin/true' | sudo tee /etc/modprobe.d/disable-cls_u32.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
sudo modprobe -r cls_u32
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
