CVE-2026-23378: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-23378 Overview

CVE-2026-23378 is an out-of-bounds write vulnerability [CWE-787] in the Linux kernel's net/sched/act_ife traffic control action. The flaw resides in the Inter-FE (IFE) action handler, which incorrectly appends new metadata to the metalist on every replace operation instead of replacing the existing entries. Repeated replace operations grow the metalist without bound, eventually causing ife_tlv_meta_encode to write past the allocated buffer during packet encoding. A local user with CAP_NET_ADMIN can trigger the condition by issuing crafted tc action replace commands.

Critical Impact
A local attacker with network administration privileges can corrupt kernel heap memory, leading to denial of service or potential local privilege escalation.

Affected Products

Linux Kernel 4.15 and later branches containing the act_ife action
Linux Kernel 7.0 release candidates rc1 through rc7
Distributions shipping vulnerable stable kernels prior to the referenced fix commits

Discovery Timeline

2026-03-25 - CVE-2026-23378 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-23378

Vulnerability Analysis

The act_ife module implements the IETF Inter-Forwarding Element action for the Linux traffic control subsystem. The action maintains a metalist describing which packet metadata fields should be encoded into outgoing frames. When userspace issues a replace command via Netlink, the handler should swap the metalist for the new configuration.

Instead, the existing implementation appends new metadata entries to the existing metalist on every replace. Each replace operation grows the structure unbounded. The fixed-size encoding buffer used by ife_tlv_meta_encode (net/ife/ife.c:168) cannot accommodate the inflated metalist. The KASAN report shows a 4-byte slab-out-of-bounds write at ffff8880077f4ffe while tcf_ife_act walks the oversized list during packet egress.

Root Cause

The replace path in act_ife.c does not free or reset the previous metalist before populating it with new entries. The metalist is shared state on the action object rather than being attached to a new RCU-protected structure for atomic swap. Repeated tc action replace invocations therefore accumulate metadata indefinitely.

Attack Vector

Exploitation requires local access and the CAP_NET_ADMIN capability or an equivalent network namespace privilege. An attacker repeatedly invokes tc action replace action ife ... with metadata parameters. After enough iterations, the next packet traversing the action invokes ife_encode_meta_u16, which calls ife_tlv_meta_encode and writes beyond the destination slab object. The resulting heap corruption can crash the kernel or be shaped into a privilege escalation primitive.

The upstream fix moves the metalist into the IFE RCU data structure so that replace operations install a fresh metalist atomically rather than mutating the existing one.

Detection Methods for CVE-2026-23378

Indicators of Compromise

KASAN reports referencing ife_tlv_meta_encode, ife_encode_meta_u16, or tcf_ife_act in dmesg
Unexpected kernel oops or panic correlated with traffic control configuration changes
Repeated tc action replace action ife invocations from non-administrator workflows

Detection Strategies

Audit auditd and execve telemetry for invocations of tc with the ife action keyword by non-root or unexpected users
Monitor Netlink RTM_NEWACTION messages targeting the IFE action type for high-frequency replace patterns
Alert on kernel ring buffer messages containing slab-out-of-bounds or BUG: KASAN strings on production hosts

Monitoring Recommendations

Forward kernel logs to a central SIEM and create rules for KASAN and Oops signatures
Track processes acquiring CAP_NET_ADMIN and correlate with subsequent tc invocations
Baseline normal traffic control configuration churn so unusual replace bursts are flagged

How to Mitigate CVE-2026-23378

Immediate Actions Required

Apply the upstream stable kernel commits referenced by the Linux kernel maintainers and reboot affected hosts
Restrict CAP_NET_ADMIN to trusted accounts and remove ambient capabilities from unrelated workloads
Unload or blacklist the act_ife module on systems that do not require Inter-FE traffic control

Patch Information

The fix is committed across stable branches. See Linux Kernel Commit 56ade7d, Linux Kernel Commit 5b144930, Linux Kernel Commit 691866c, Linux Kernel Commit 91a89d3, Linux Kernel Commit cd888c3, and Linux Kernel Commit e2cedd4. The patches relocate the metalist into the IFE RCU data structure so replace operations install a new list rather than appending.

Workarounds

Blacklist the act_ife kernel module if Inter-FE actions are not in use
Use seccomp or LSM policies to deny tc action manipulation from non-administrative service accounts
Run untrusted workloads in network namespaces without CAP_NET_ADMIN

bash

# Configuration example
# Blacklist the act_ife module to prevent loading
echo 'blacklist act_ife' | sudo tee /etc/modprobe.d/blacklist-act_ife.conf
sudo rmmod act_ife 2>/dev/null

# Verify the module is no longer loaded
lsmod | grep act_ife