PT-2026-27743 · Linux · Linux Kernel
Published
2026-01-01
·
Updated
2026-05-03
·
CVE-2026-23378
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 7.0.0-rc1-00169-gfbdfa8da05b6
Description
The Linux kernel contains a flaw in the
net/sched component, specifically within the act ife module. An incorrect metalist update behavior can occur when an ife action is replaced, leading to an unbounded addition of metadata to the metalist. This can potentially cause an out-of-bounds error during the encode operation, as demonstrated by a KASAN report. The issue is related to the ife tlv meta encode function and the ife encode meta u16 function. The tcf ife act function is also involved in the process.Recommendations
Update the Linux kernel to version 7.0.0-rc1-00169-gfbdfa8da05b6 or later.
Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel