Security readout for executives and security teams
Plain-English summary
CVE-2026-23204 is a Linux kernel bug in the traffic-control u32 classifier. A local low-privileged attacker may be able to trigger an out-of-bounds kernel memory access, risking information exposure or a system crash. The source bundle does not show confirmed active exploitation.
Executive priority
Prioritize patching shared Linux hosts, container platforms, and multi-user systems. This is not described as remotely exploitable, but kernel memory exposure and crash impact make it important for environments with untrusted local users or workloads.
Technical view
The kernel cls_u32 path used skb_header_pointer(), which did not fully validate negative offset values. The fix switches to skb_header_pointer_careful(). The report includes a KASAN slab-out-of-bounds finding in u32_classify() at net/sched/cls_u32.c:221. CVSS is 7.1, local, low complexity, low privileges, no user interaction.
Likely exposure
Linux systems running affected kernel builds are the exposure. Risk is highest where low-privileged local users or workloads can reach the vulnerable kernel path. Distribution backports may affect version-based checks, so confirm package status with the OS vendor.
Exploitation context
The CVE record rates exploitation as local with low privileges and no user interaction. KEV is false in the supplied bundle, and no cited source confirms exploitation in the wild. A repro was reported to the kernel maintainers, but the bundle does not provide public weaponization details.
Researcher notes
Key evidence is the upstream kernel description and stable commit references. The affected-version data in the bundle is broad and commit-oriented; use vendor package metadata for final exposure decisions. Do not treat KEV-negative status as proof of no private exploitation.
Mitigation direction
- Apply vendor kernel updates containing the cls_u32 skb_header_pointer_careful() fix.
- Confirm whether your distribution backported the referenced stable commits.
- Restrict unnecessary local shell and workload access on unpatched systems.
- Limit traffic-control administration privileges to trusted administrators.
- Monitor kernel logs for crashes or cls_u32/u32_classify faults.
Validation and detection
- Inventory Linux kernel versions across servers, hosts, and appliances.
- Map each system to vendor advisories or patched kernel packages.
- Check whether cls_u32 traffic-control functionality is used on exposed hosts.
- Verify scanners identify patched backported kernels correctly.
- Review kernel logs for related out-of-bounds or crash indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23204 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136CVE reference, Linux
- https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72cCVE reference, Linux
- https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7CVE reference, Linux
- https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5CVE reference, Linux
- https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5CVE reference, Linux
- https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943CVE reference, Linux
- https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.