CVE-2026-23331 Overview
CVE-2026-23331 is a kernel vulnerability in the Linux UDP networking subsystem. The flaw lives in the socket disconnect path for auto-bound, connected UDP sockets. When a process binds a UDP socket to the wildcard address with a non-zero port, connects it to a remote peer, and then disconnects, the kernel fails to remove the socket from the 4-tuple hash table. The stale entry remains in the hash chain, leaving inconsistent state inside udp_sk(sk)->udp_portaddr_hash and the 4-tuple lookup structures. The defect affects Linux kernel 6.13 and the 7.0 release candidate series, and was resolved through upstream stable commits.
Critical Impact
Local users can corrupt UDP hash table state, leading to availability impact on the host networking stack.
Affected Products
- Linux kernel 6.13
- Linux kernel 7.0-rc1 through 7.0-rc7
- Distributions shipping the affected stable branches
Discovery Timeline
- 2026-03-25 - CVE-2026-23331 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2026-23331
Vulnerability Analysis
The vulnerability resides in the Linux kernel UDP socket lifecycle handling. A bind() call to the wildcard address with a non-zero port sets SOCK_BINDPORT_LOCK on sk->sk_userlocks but does not set SOCK_BINDADDR_LOCK. A subsequent connect() call routes the socket through udp_lib_hash4(), which inserts it into the 4-tuple hash table keyed on the full source and destination tuple.
When the application later disconnects the socket, __udp_disconnect() invokes sk->sk_prot->rehash(sk). The rehash routine computes a new hash based on the wildcard address and moves the socket to a different slot. The original entry in the 4-tuple hash table is not unlinked, leaving an orphaned chain element that no incoming packet can match. Repeated bind, connect, and disconnect sequences accumulate stale entries that degrade hash table integrity and lookup performance.
Root Cause
The root cause is missing unhash logic in the UDP disconnect path. __udp_disconnect() rehashes the socket but does not call udp_unhash4() to remove it from the 4-tuple hash table before recomputing slot membership. Additionally, udp_sk(sk)->udp_portaddr_hash must be updated after udp_hash4_dec(hslot2) inside udp_unhash4() to maintain consistent state.
Attack Vector
Exploitation requires local access and the ability to execute UDP socket system calls. An attacker invokes bind(), connect(), and disconnect (via connect() to AF_UNSPEC) in a loop. Each iteration leaves a stale entry in the 4-tuple hash table, corrupting kernel data structures and producing availability impact (CWE classification: NVD-CWE-noinfo). The vulnerability does not expose confidentiality or integrity, but its high availability impact reflects denial-of-service potential on the networking subsystem.
The vulnerability is described in prose form. Review the upstream commits 3b8f104880c1, 6996a2d2d0a6, and b955350778b8 for the corrective code paths.
Detection Methods for CVE-2026-23331
Indicators of Compromise
- Repeated UDP bind()/connect()/disconnect sequences from a single non-privileged process
- Growing kernel memory consumption in UDP hash table slots without corresponding active sockets
- Degraded UDP lookup performance reported by network telemetry on affected hosts
Detection Strategies
- Audit running kernel versions across the fleet to identify hosts on Linux 6.13 or 7.0 release candidates
- Monitor auditd and syscall telemetry for processes performing high-frequency UDP socket rebinding patterns
- Inspect /proc/net/udp and /proc/net/udp6 for unexpected entry growth correlated with low active connection counts
Monitoring Recommendations
- Forward host syscall and kernel telemetry to a centralized analytics platform for correlation
- Alert on unprivileged processes performing sustained connect() to AF_UNSPEC operations on UDP sockets
- Track kernel slab allocator metrics for UDP-related caches to detect anomalous growth
How to Mitigate CVE-2026-23331
Immediate Actions Required
- Apply the upstream stable kernel patches that introduce udp_unhash4() invocation in the disconnect path
- Update to a distribution kernel that includes commits 3b8f104880c1, 6996a2d2d0a6, and b955350778b8
- Restrict local code execution on multi-tenant hosts until patched kernels are deployed
Patch Information
The Linux kernel maintainers resolved this issue across three stable commits. Apply the fix from the upstream kernel repository: Kernel commit 3b8f104880c1, Kernel commit 6996a2d2d0a6, and Kernel commit b955350778b8. Rebuild and reboot the host after patching to load the corrected UDP socket disconnect path.
Workarounds
- Limit local user access on shared systems to reduce exposure to malicious socket churn
- Apply seccomp filters restricting unnecessary UDP socket reconfiguration in untrusted workloads
- Use cgroup-based resource controls to cap socket creation rates for non-privileged users
# Verify current kernel version and check for the fix
uname -r
git log --oneline | grep -E '3b8f104880c1|6996a2d2d0a6|b955350778b8'
# Example seccomp policy snippet to limit UDP socket churn
# Apply via systemd unit: SystemCallFilter=~socket connect
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
