Security readout for executives and security teams
Plain-English summary
A specially formed GUE network packet can cause an affected Linux kernel to retain packet memory instead of releasing it. Repeated traffic could consume memory and disrupt system availability. The supplied assessment rates this high at CVSS 7.5, with no confidentiality or integrity impact identified.
Executive priority
Treat this as a high-priority availability issue for exposed GUE infrastructure, especially critical gateways and hosts. Patch promptly after normal compatibility testing. Systems without reachable GUE processing can follow a risk-based maintenance schedule once exposure is verified.
Technical view
The GUE receive path returned a zero inner protocol as a resubmission value, although resubmission requires a non-zero protocol number. This left the socket buffer unfreed. The kernel fix drops GUE packets whose inner protocol is zero, preventing the leak.
Likely exposure
Exposure is most plausible on Linux systems that receive GUE traffic from untrusted networks. Systems not processing GUE have lower practical risk. The bundle identifies multiple stable kernel lines but does not clearly provide complete introduced-through-fixed version ranges, so verify vendor backports by build.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Discovery came from syzbot with a reproducer. The supplied CVSS vector describes network-reachable, low-complexity, unauthenticated exploitation affecting availability only.
Researcher notes
Protocol value zero is valid for IPv6 Hop-by-Hop Options, but the patch treats it as impractical inside GUE and drops such packets. The source bundle contains duplicated commit identifiers and ambiguous version entries; branch-specific applicability should be confirmed against stable commits or vendor advisories.
Mitigation direction
- Inventory Linux systems receiving GUE traffic and record their kernel builds.
- Apply vendor kernel updates containing the appropriate stable fix for each maintained branch.
- Consult Linux distribution or appliance-vendor guidance for confirmed fixed package versions.
- Prioritize externally reachable GUE endpoints and systems where memory exhaustion would cause material disruption.
Validation and detection
- Confirm each installed kernel includes the corresponding stable commit or an authenticated vendor backport.
- Verify no affected kernel builds remain on systems that process untrusted GUE traffic.
- Review network paths to determine whether untrusted GUE packets can reach potentially affected receivers.
- Monitor relevant systems for abnormal kernel memory growth and packet-processing instability after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23095 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/886f186328b718400dbf79e1bc8cbcbd710ab766CVE reference, Linux
- https://git.kernel.org/stable/c/380a82d36e37db49fd41ecc378c22fd29392e96aCVE reference, Linux
- https://git.kernel.org/stable/c/536f5bbc322eb1e175bdd1ced22b236a951c4d8fCVE reference, Linux
- https://git.kernel.org/stable/c/f87b9b7a618c82e7465e872eb10e14c803871892CVE reference, Linux
- https://git.kernel.org/stable/c/ce569b389a5c78d64788a5ea94560e17fa574b35CVE reference, Linux
- https://git.kernel.org/stable/c/5437a279804ced8088cabb945dba88a26d828f8cCVE reference, Linux
- https://git.kernel.org/stable/c/9a56796ad258786d3624eef5aefba394fc9bddedCVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.