GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-23095 (GCVE-0-2026-23095)

Vulnerability from cvelistv5 – Published: 2026-02-04 16:08 – Updated: 2026-09-08 08:44
VLAI
Title
gue: Fix skb memleak with inner IP protocol 0.
Summary
In the Linux kernel, the following vulnerability has been resolved: gue: Fix skb memleak with inner IP protocol 0. syzbot reported skb memleak below. [0] The repro generated a GUE packet with its inner protocol 0. gue_udp_recv() returns -guehdr->proto_ctype for "resubmit" in ip_protocol_deliver_rcu(), but this only works with non-zero protocol number. Let's drop such packets. Note that 0 is a valid number (IPv6 Hop-by-Hop Option). I think it is not practical to encap HOPOPT in GUE, so once someone starts to complain, we could pass down a resubmit flag pointer to distinguish two zeros from the upper layer: * no error * resubmit HOPOPT [0] BUG: memory leak unreferenced object 0xffff888109695a00 (size 240): comm "syz.0.17", pid 6088, jiffies 4294943096 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace (crc a84b336f): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4958 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270 __build_skb+0x23/0x60 net/core/skbuff.c:474 build_skb+0x20/0x190 net/core/skbuff.c:490 __tun_build_skb drivers/net/tun.c:1541 [inline] tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636 tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770 tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x45d/0x710 fs/read_write.c:686 ksys_write+0xa7/0x170 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-16 20:19 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < 886f186328b718400dbf79e1bc8cbcbd710ab766 (git)
Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < 380a82d36e37db49fd41ecc378c22fd29392e96a (git)
Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < 536f5bbc322eb1e175bdd1ced22b236a951c4d8f (git)
Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < f87b9b7a618c82e7465e872eb10e14c803871892 (git)
Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < ce569b389a5c78d64788a5ea94560e17fa574b35 (git)
Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < 5437a279804ced8088cabb945dba88a26d828f8c (git)
Affected: 37dd0247797b168ad1cc7f5dbec825a1ee66535b , < 9a56796ad258786d3624eef5aefba394fc9bdded (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 5.10.249 , ≤ 5.10.* (semver)
Unaffected: 5.15.199 , ≤ 5.15.* (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.68 , ≤ 6.12.* (semver)
Unaffected: 6.18.8 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23095",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:19:57.582925Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:20:08.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:52.392Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fou_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "886f186328b718400dbf79e1bc8cbcbd710ab766",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            },
            {
              "lessThan": "380a82d36e37db49fd41ecc378c22fd29392e96a",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            },
            {
              "lessThan": "536f5bbc322eb1e175bdd1ced22b236a951c4d8f",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            },
            {
              "lessThan": "f87b9b7a618c82e7465e872eb10e14c803871892",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            },
            {
              "lessThan": "ce569b389a5c78d64788a5ea94560e17fa574b35",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            },
            {
              "lessThan": "5437a279804ced8088cabb945dba88a26d828f8c",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            },
            {
              "lessThan": "9a56796ad258786d3624eef5aefba394fc9bdded",
              "status": "affected",
              "version": "37dd0247797b168ad1cc7f5dbec825a1ee66535b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fou_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngue: Fix skb memleak with inner IP protocol 0.\n\nsyzbot reported skb memleak below. [0]\n\nThe repro generated a GUE packet with its inner protocol 0.\n\ngue_udp_recv() returns -guehdr-\u003eproto_ctype for \"resubmit\"\nin ip_protocol_deliver_rcu(), but this only works with\nnon-zero protocol number.\n\nLet\u0027s drop such packets.\n\nNote that 0 is a valid number (IPv6 Hop-by-Hop Option).\n\nI think it is not practical to encap HOPOPT in GUE, so once\nsomeone starts to complain, we could pass down a resubmit\nflag pointer to distinguish two zeros from the upper layer:\n\n  * no error\n  * resubmit HOPOPT\n\n[0]\nBUG: memory leak\nunreferenced object 0xffff888109695a00 (size 240):\n  comm \"syz.0.17\", pid 6088, jiffies 4294943096\n  hex dump (first 32 bytes):\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\n    00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............\n  backtrace (crc a84b336f):\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n    slab_post_alloc_hook mm/slub.c:4958 [inline]\n    slab_alloc_node mm/slub.c:5263 [inline]\n    kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270\n    __build_skb+0x23/0x60 net/core/skbuff.c:474\n    build_skb+0x20/0x190 net/core/skbuff.c:490\n    __tun_build_skb drivers/net/tun.c:1541 [inline]\n    tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636\n    tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770\n    tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999\n    new_sync_write fs/read_write.c:593 [inline]\n    vfs_write+0x45d/0x710 fs/read_write.c:686\n    ksys_write+0xa7/0x170 fs/read_write.c:738\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - GUE processes incoming UDP packets from the network. Once a GUE tunnel is configured (its intended purpose in datacenter/cloud deployments), any remote attacker can send crafted UDP packets to the GUE port to trigger the leak.\nAC:L - The attacker simply sends a UDP packet with a GUE header containing proto_ctype=0. No race conditions, no special timing, and no conditions beyond the attacker\u0027s control once the GUE tunnel endpoint exists.\nPR:N - No authentication or privileges are needed to send UDP packets to a GUE tunnel endpoint. The vulnerability is in the packet receive path which processes all incoming packets without any authentication gate.\nUI:N - No user interaction is required. The vulnerability is triggered purely by receiving a crafted network packet.\nS:U - The vulnerability affects kernel memory within the same security authority. No scope boundary (VM, sandbox, IOMMU) is crossed.\nC:N - This is a pure memory leak \u2014 the skb is not freed but no memory contents are disclosed to the attacker. There is no information disclosure path.\nI:N - This is a memory leak, not a memory corruption. No kernel data structures are modified or corrupted; the skb simply becomes unreachable and is never freed.\nA:H - The attacker can repeatedly send crafted GUE packets over the network at high rate, each leaking ~240 bytes of kernel memory. This amplifiable, remotely-triggered leak can exhaust kernel memory causing OOM conditions and system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:14.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/886f186328b718400dbf79e1bc8cbcbd710ab766"
        },
        {
          "url": "https://git.kernel.org/stable/c/380a82d36e37db49fd41ecc378c22fd29392e96a"
        },
        {
          "url": "https://git.kernel.org/stable/c/536f5bbc322eb1e175bdd1ced22b236a951c4d8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f87b9b7a618c82e7465e872eb10e14c803871892"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce569b389a5c78d64788a5ea94560e17fa574b35"
        },
        {
          "url": "https://git.kernel.org/stable/c/5437a279804ced8088cabb945dba88a26d828f8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a56796ad258786d3624eef5aefba394fc9bdded"
        }
      ],
      "title": "gue: Fix skb memleak with inner IP protocol 0.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23095",
    "datePublished": "2026-02-04T16:08:17.990Z",
    "dateReserved": "2026-01-13T15:37:45.963Z",
    "dateUpdated": "2026-09-08T08:44:52.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23095",
      "date": "2026-09-16",
      "epss": "0.00248",
      "percentile": "0.16275"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23095\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-04T17:16:20.370\",\"lastModified\":\"2026-07-14T13:18:24.410\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngue: Fix skb memleak with inner IP protocol 0.\\n\\nsyzbot reported skb memleak below. [0]\\n\\nThe repro generated a GUE packet with its inner protocol 0.\\n\\ngue_udp_recv() returns -guehdr-\u003eproto_ctype for \\\"resubmit\\\"\\nin ip_protocol_deliver_rcu(), but this only works with\\nnon-zero protocol number.\\n\\nLet\u0027s drop such packets.\\n\\nNote that 0 is a valid number (IPv6 Hop-by-Hop Option).\\n\\nI think it is not practical to encap HOPOPT in GUE, so once\\nsomeone starts to complain, we could pass down a resubmit\\nflag pointer to distinguish two zeros from the upper layer:\\n\\n  * no error\\n  * resubmit HOPOPT\\n\\n[0]\\nBUG: memory leak\\nunreferenced object 0xffff888109695a00 (size 240):\\n  comm \\\"syz.0.17\\\", pid 6088, jiffies 4294943096\\n  hex dump (first 32 bytes):\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n    00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............\\n  backtrace (crc a84b336f):\\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\\n    slab_post_alloc_hook mm/slub.c:4958 [inline]\\n    slab_alloc_node mm/slub.c:5263 [inline]\\n    kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270\\n    __build_skb+0x23/0x60 net/core/skbuff.c:474\\n    build_skb+0x20/0x190 net/core/skbuff.c:490\\n    __tun_build_skb drivers/net/tun.c:1541 [inline]\\n    tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636\\n    tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770\\n    tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999\\n    new_sync_write fs/read_write.c:593 [inline]\\n    vfs_write+0x45d/0x710 fs/read_write.c:686\\n    ksys_write+0xa7/0x170 fs/read_write.c:738\\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94\\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ngue: Corrige la fuga de memoria de skb con el protocolo IP interno 0.\\n\\nsyzbot inform\u00f3 de una fuga de memoria de skb a continuaci\u00f3n. [0]\\n\\nLa reproducci\u00f3n gener\u00f3 un paquete GUE con su protocolo interno 0.\\n\\ngue_udp_recv() devuelve -guehdr-\u0026gt;proto_ctype para \u0027resubmit\u0027 en ip_protocol_deliver_rcu(), pero esto solo funciona con n\u00fameros de protocolo distintos de cero.\\n\\nDescartemos tales paquetes.\\n\\nTenga en cuenta que 0 es un n\u00famero v\u00e1lido (Opci\u00f3n Salto a Salto de IPv6).\\n\\nCreo que no es pr\u00e1ctico encapsular HOPOPT en GUE, as\u00ed que una vez que alguien empiece a quejarse, podr\u00edamos pasar un puntero de bandera de reenv\u00edo para distinguir dos ceros de la capa superior:\\n\\n  * sin error\\n  * reenviar HOPOPT\\n\\n[0]\\nBUG: fuga de memoria\\nobjeto sin referencia 0xffff888109695a00 (tama\u00f1o 240):\\n  comm \u0027syz.0.17\u0027, pid 6088, jiffies 4294943096\\n  volcado hexadecimal (primeros 32 bytes):\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n    00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............\\n  rastreo (crc a84b336f):\\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\\n    slab_post_alloc_hook mm/slub.c:4958 [inline]\\n    slab_alloc_node mm/slub.c:5263 [inline]\\n    kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270\\n    __build_skb+0x23/0x60 net/core/skbuff.c:474\\n    build_skb+0x20/0x190 net/core/skbuff.c:490\\n    __tun_build_skb drivers/net/tun.c:1541 [inline]\\n    tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636\\n    tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770\\n    tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999\\n    new_sync_write fs/read_write.c:593 [inline]\\n    vfs_write+0x45d/0x710 fs/read_write.c:686\\n    ksys_write+0xa7/0x170 fs/read_write.c:738\\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94\\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/fou_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"886f186328b718400dbf79e1bc8cbcbd710ab766\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"380a82d36e37db49fd41ecc378c22fd29392e96a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"536f5bbc322eb1e175bdd1ced22b236a951c4d8f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"f87b9b7a618c82e7465e872eb10e14c803871892\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"ce569b389a5c78d64788a5ea94560e17fa574b35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"5437a279804ced8088cabb945dba88a26d828f8c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"37dd0247797b168ad1cc7f5dbec825a1ee66535b\",\"lessThan\":\"9a56796ad258786d3624eef5aefba394fc9bdded\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/fou_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.249\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.199\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.122\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.68\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.8\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-16T20:19:57.582925Z\",\"id\":\"CVE-2026-23095\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.18\",\"versionEndExcluding\":\"5.10.249\",\"matchCriteriaId\":\"C0E32AE9-6434-429F-8548-532124F03BA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.199\",\"matchCriteriaId\":\"A247FBA6-BEB9-484F-B892-DD5517949CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"6579E0D4-0641-479D-A4C3-0EF618798C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.122\",\"matchCriteriaId\":\"8EAAE395-0162-4BAF-9AD5-E9AF3C869C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.68\",\"matchCriteriaId\":\"52F38E19-0FDD-4992-9D6D-D4169D689598\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.8\",\"matchCriteriaId\":\"E65C6E79-7EBE-4C77-93F0-818CF5B38F4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/380a82d36e37db49fd41ecc378c22fd29392e96a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/536f5bbc322eb1e175bdd1ced22b236a951c4d8f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5437a279804ced8088cabb945dba88a26d828f8c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/886f186328b718400dbf79e1bc8cbcbd710ab766\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a56796ad258786d3624eef5aefba394fc9bdded\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce569b389a5c78d64788a5ea94560e17fa574b35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f87b9b7a618c82e7465e872eb10e14c803871892\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T17:53:30+00:00",
      "cve": "CVE-2026-23095",
      "id": "CVE-2026-23095",
      "initial_release_date": "2026-02-04T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Denial of Service in GUE due to memory leak",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23095.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:25:24Z",
      "cve": "CVE-2026-23095",
      "id": "CVE-2026-23095",
      "initial_release_date": "2026-02-05T00:24:37Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "697",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "317",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23095",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23095.json",
      "version": "32"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-09-08T08:44:52.392Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-23095\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-16T20:19:57.582925Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-16T20:20:03.302Z\"}}], \"cna\": {\"title\": \"gue: Fix skb memleak with inner IP protocol 0.\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - GUE processes incoming UDP packets from the network. Once a GUE tunnel is configured (its intended purpose in datacenter/cloud deployments), any remote attacker can send crafted UDP packets to the GUE port to trigger the leak.\\nAC:L - The attacker simply sends a UDP packet with a GUE header containing proto_ctype=0. No race conditions, no special timing, and no conditions beyond the attacker\u0027s control once the GUE tunnel endpoint exists.\\nPR:N - No authentication or privileges are needed to send UDP packets to a GUE tunnel endpoint. The vulnerability is in the packet receive path which processes all incoming packets without any authentication gate.\\nUI:N - No user interaction is required. The vulnerability is triggered purely by receiving a crafted network packet.\\nS:U - The vulnerability affects kernel memory within the same security authority. No scope boundary (VM, sandbox, IOMMU) is crossed.\\nC:N - This is a pure memory leak \\u2014 the skb is not freed but no memory contents are disclosed to the attacker. There is no information disclosure path.\\nI:N - This is a memory leak, not a memory corruption. No kernel data structures are modified or corrupted; the skb simply becomes unreachable and is never freed.\\nA:H - The attacker can repeatedly send crafted GUE packets over the network at high rate, each leaking ~240 bytes of kernel memory. This amplifiable, remotely-triggered leak can exhaust kernel memory causing OOM conditions and system-wide denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"886f186328b718400dbf79e1bc8cbcbd710ab766\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"380a82d36e37db49fd41ecc378c22fd29392e96a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"536f5bbc322eb1e175bdd1ced22b236a951c4d8f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"f87b9b7a618c82e7465e872eb10e14c803871892\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"ce569b389a5c78d64788a5ea94560e17fa574b35\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"5437a279804ced8088cabb945dba88a26d828f8c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37dd0247797b168ad1cc7f5dbec825a1ee66535b\", \"lessThan\": \"9a56796ad258786d3624eef5aefba394fc9bdded\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/fou_core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.249\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.199\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.122\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.68\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/fou_core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/886f186328b718400dbf79e1bc8cbcbd710ab766\"}, {\"url\": \"https://git.kernel.org/stable/c/380a82d36e37db49fd41ecc378c22fd29392e96a\"}, {\"url\": \"https://git.kernel.org/stable/c/536f5bbc322eb1e175bdd1ced22b236a951c4d8f\"}, {\"url\": \"https://git.kernel.org/stable/c/f87b9b7a618c82e7465e872eb10e14c803871892\"}, {\"url\": \"https://git.kernel.org/stable/c/ce569b389a5c78d64788a5ea94560e17fa574b35\"}, {\"url\": \"https://git.kernel.org/stable/c/5437a279804ced8088cabb945dba88a26d828f8c\"}, {\"url\": \"https://git.kernel.org/stable/c/9a56796ad258786d3624eef5aefba394fc9bdded\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngue: Fix skb memleak with inner IP protocol 0.\\n\\nsyzbot reported skb memleak below. [0]\\n\\nThe repro generated a GUE packet with its inner protocol 0.\\n\\ngue_udp_recv() returns -guehdr-\u003eproto_ctype for \\\"resubmit\\\"\\nin ip_protocol_deliver_rcu(), but this only works with\\nnon-zero protocol number.\\n\\nLet\u0027s drop such packets.\\n\\nNote that 0 is a valid number (IPv6 Hop-by-Hop Option).\\n\\nI think it is not practical to encap HOPOPT in GUE, so once\\nsomeone starts to complain, we could pass down a resubmit\\nflag pointer to distinguish two zeros from the upper layer:\\n\\n  * no error\\n  * resubmit HOPOPT\\n\\n[0]\\nBUG: memory leak\\nunreferenced object 0xffff888109695a00 (size 240):\\n  comm \\\"syz.0.17\\\", pid 6088, jiffies 4294943096\\n  hex dump (first 32 bytes):\\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................\\n    00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00  .@..............\\n  backtrace (crc a84b336f):\\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\\n    slab_post_alloc_hook mm/slub.c:4958 [inline]\\n    slab_alloc_node mm/slub.c:5263 [inline]\\n    kmem_cache_alloc_noprof+0x3b4/0x590 mm/slub.c:5270\\n    __build_skb+0x23/0x60 net/core/skbuff.c:474\\n    build_skb+0x20/0x190 net/core/skbuff.c:490\\n    __tun_build_skb drivers/net/tun.c:1541 [inline]\\n    tun_build_skb+0x4a1/0xa40 drivers/net/tun.c:1636\\n    tun_get_user+0xc12/0x2030 drivers/net/tun.c:1770\\n    tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:1999\\n    new_sync_write fs/read_write.c:593 [inline]\\n    vfs_write+0x45d/0x710 fs/read_write.c:686\\n    ksys_write+0xa7/0x170 fs/read_write.c:738\\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94\\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.249\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.199\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.162\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.122\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.68\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.8\", \"versionStartIncluding\": \"3.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"3.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:20:14.188Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-23095\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T08:44:52.392Z\", \"dateReserved\": \"2026-01-13T15:37:45.963Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-02-04T16:08:17.990Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.