CVE-2026-23331: Linux Kernel UDP DOS Vulnerability

CVE-2026-23331 Overview

A vulnerability has been identified in the Linux kernel's UDP networking subsystem where connected sockets bound to wildcard addresses are not properly removed from the 4-tuple hash table when disconnected. This flaw occurs in the socket disconnection handling logic, specifically in the __udp_disconnect() function, which incorrectly attempts to rehash the socket rather than removing it from the hash table entirely.

When a UDP socket is bound to a wildcard address with a non-zero port and subsequently connected and disconnected, the kernel's rehash operation moves the socket to a new slot in the 4-tuple hash table based on the wildcard address. This leaves stale entries in the hash chain that no packet will ever match, leading to potential memory corruption and system instability.

Critical Impact

This vulnerability can result in hash table corruption in the Linux kernel's UDP networking stack, potentially leading to system instability, denial of service conditions, or unpredictable network behavior on affected systems.

Affected Products

• Linux Kernel (UDP networking subsystem)
• Systems using UDP socket auto-binding with connect/disconnect operations

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23331 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23331

Vulnerability Analysis

This vulnerability affects the UDP socket handling in the Linux kernel networking stack. The issue arises from improper socket lifecycle management when a UDP socket undergoes a specific sequence of operations: binding to a wildcard address (0.0.0.0 or ::) with a specified port, connecting to a remote address, and then disconnecting.

During the bind() operation, the kernel sets SOCK_BINDPORT_LOCK on sk->sk_userlocks but does not set SOCK_BINDADDR_LOCK. When connect() is called, the kernel invokes udp_lib_hash4() to insert the socket into the 4-tuple hash table for efficient packet lookup.

The problem manifests when __udp_disconnect() is called. Instead of properly removing the socket from the 4-tuple hash table, it calls sk->sk_prot->rehash(sk), which computes a new hash based on the wildcard address and moves the socket to a different slot. This leaves orphaned entries in the original hash chain.

Root Cause

The root cause is the incorrect handling of socket state transitions in the __udp_disconnect() function. When disconnecting an auto-bound connected socket, the kernel should call udp_unhash4() to properly remove the socket from the 4-tuple hash table. Instead, the rehash operation creates dangling references in the hash chain.

Additionally, the udp_sk(sk)->udp_portaddr_hash field needs to be updated after udp_hash4_dec(hslot2) is called in udp_unhash4() to maintain consistency in the hash table data structures.

Attack Vector

The vulnerability requires local access to create and manipulate UDP sockets. An attacker or application can trigger this condition through the following sequence:

1. Create a UDP socket using socket(AF_INET, SOCK_DGRAM, 0)
2. Bind the socket to a wildcard address with a specific port using bind()
3. Connect the socket to a remote address using connect()
4. Disconnect the socket by calling connect() with AF_UNSPEC
5. Repeat steps 3-4 multiple times to accumulate garbage entries in the hash table

This can lead to hash table corruption, potentially causing denial of service through resource exhaustion or unpredictable kernel behavior when processing UDP packets.

Detection Methods for CVE-2026-23331

Indicators of Compromise

• Unusual system performance degradation related to UDP networking operations
• Kernel warnings or errors related to UDP socket hash table operations in system logs
• Memory usage anomalies in networking subsystem kernel structures
• Unexpected UDP packet delivery failures or delays

Detection Strategies

• Monitor kernel logs for warnings related to UDP socket operations or hash table inconsistencies
• Implement system call auditing for repeated patterns of UDP socket bind/connect/disconnect operations
• Use kernel debugging tools such as ftrace or eBPF to monitor __udp_disconnect() and related hash table functions
• Deploy SentinelOne Singularity XDR for real-time kernel-level threat detection and behavioral analysis

Monitoring Recommendations

• Enable kernel auditing for socket-related system calls (socket, bind, connect)
• Monitor for applications performing rapid UDP socket connect/disconnect cycles
• Review system logs periodically for networking subsystem anomalies
• Implement network performance baselines to detect degradation patterns

How to Mitigate CVE-2026-23331

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the fix for this vulnerability
• Review and apply kernel patches from the official kernel git repository
• Assess systems for applications that may trigger the vulnerable code path
• Consider implementing network namespace isolation for untrusted applications

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix ensures that auto-bound connected sockets are properly removed from the 4-tuple hash table when disconnected, rather than being rehashed incorrectly.

Patch commits are available from the stable kernel git repository:

• Kernel Git Commit 3b8f104
• Kernel Git Commit 6996a2d
• Kernel Git Commit b955350

Apply the appropriate patch for your kernel version and rebuild the kernel or wait for distribution-specific updates.

Workarounds

• Limit UDP socket operations to trusted applications only through SELinux or AppArmor policies
• Implement seccomp filters to restrict socket-related system calls for untrusted processes
• Monitor and rate-limit applications performing frequent UDP socket connect/disconnect operations
• Consider using TCP instead of UDP where application requirements permit

# Example: Check current kernel version and verify if patched
uname -r

# Example: Monitor for vulnerable socket operations using auditd
auditctl -a always,exit -F arch=b64 -S connect -F a1=2 -k udp_connect_monitor