CVE-2026-23204

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221

An out of bounds memory access vulnerability exists in the Linux traffic control u32 classifier implementation. In u32_classify the kernel calculates offsets such as toff using key off values masks and variable offsets and then dereferences packet data using skb_header_pointer. The helper skb_header_pointer does not fully validate negative offset values. With a crafted configuration and packet layout the computed offset can become negative or otherwise invalid in a way that bypasses the existing checks and results in an out of bounds access. The most direct impact is a kernel crash causing a denial of service. Because the access pattern involves reading packet data at attacker influenced offsets it may also allow information disclosure of adjacent kernel memory and in worst cases could contribute to privilege escalation chains. Exploitation prerequisites depend on whether the system has tc u32 filters configured on a traffic path. For the CVSS the base score uses PR:L because configuring tc filters typically requires elevated privileges but can be available in containers or network namespaces with CAP_NET_ADMIN.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.