CVE-2026-23326 (GCVE-0-2026-23326)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-05-11 22:04
VLAI
Title
xsk: Fix fragment node deletion to prevent buffer leak
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node is reinitialized after removal, allowing the list_empty() to work correctly.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 560c974b7ccd95bb9ff20df77f6654283e45c9c6 , < 5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d (git)
Affected: fd5614763805d6f386bd07cc53558f88b1b1eb62 , < 2a9ea988465ece5b6896b1bdc144170a64e84c35 (git)
Affected: b692bf9a7543af7ad11a59d182a3757578f0ba53 , < 645c6d8376ad4913cbffe0e0c2cca0c4febbe596 (git)
Affected: b692bf9a7543af7ad11a59d182a3757578f0ba53 , < b38cbd4af5034635cff109e08788c63f956f3a69 (git)
Affected: b692bf9a7543af7ad11a59d182a3757578f0ba53 , < 60abb0ac11dccd6b98fd9182bc5f85b621688861 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/xdp_sock_drv.h",
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d",
              "status": "affected",
              "version": "560c974b7ccd95bb9ff20df77f6654283e45c9c6",
              "versionType": "git"
            },
            {
              "lessThan": "2a9ea988465ece5b6896b1bdc144170a64e84c35",
              "status": "affected",
              "version": "fd5614763805d6f386bd07cc53558f88b1b1eb62",
              "versionType": "git"
            },
            {
              "lessThan": "645c6d8376ad4913cbffe0e0c2cca0c4febbe596",
              "status": "affected",
              "version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
              "versionType": "git"
            },
            {
              "lessThan": "b38cbd4af5034635cff109e08788c63f956f3a69",
              "status": "affected",
              "version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
              "versionType": "git"
            },
            {
              "lessThan": "60abb0ac11dccd6b98fd9182bc5f85b621688861",
              "status": "affected",
              "version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/xdp_sock_drv.h",
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix fragment node deletion to prevent buffer leak\n\nAfter commit b692bf9a7543 (\"xsk: Get rid of xdp_buff_xsk::xskb_list_node\"),\nthe list_node field is reused for both the xskb pool list and the buffer\nfree list, this causes a buffer leak as described below.\n\nxp_free() checks if a buffer is already on the free list using\nlist_empty(\u0026xskb-\u003elist_node). When list_del() is used to remove a node\nfrom the xskb pool list, it doesn\u0027t reinitialize the node pointers.\nThis means list_empty() will return false even after the node has been\nremoved, causing xp_free() to incorrectly skip adding the buffer to the\nfree list.\n\nFix this by using list_del_init() instead of list_del() in all fragment\nhandling paths, this ensures the list node is reinitialized after removal,\nallowing the list_empty() to work correctly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:04:42.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a9ea988465ece5b6896b1bdc144170a64e84c35"
        },
        {
          "url": "https://git.kernel.org/stable/c/645c6d8376ad4913cbffe0e0c2cca0c4febbe596"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38cbd4af5034635cff109e08788c63f956f3a69"
        },
        {
          "url": "https://git.kernel.org/stable/c/60abb0ac11dccd6b98fd9182bc5f85b621688861"
        }
      ],
      "title": "xsk: Fix fragment node deletion to prevent buffer leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23326",
    "datePublished": "2026-03-25T10:27:19.021Z",
    "dateReserved": "2026-01-13T15:37:45.996Z",
    "dateUpdated": "2026-05-11T22:04:42.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23326",
      "date": "2026-09-27",
      "epss": "0.00129",
      "percentile": "0.02102"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xdp_sock_drv.h",
                  "net/xdp/xsk.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d",
                    "status": "affected",
                    "version": "560c974b7ccd95bb9ff20df77f6654283e45c9c6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2a9ea988465ece5b6896b1bdc144170a64e84c35",
                    "status": "affected",
                    "version": "fd5614763805d6f386bd07cc53558f88b1b1eb62",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "645c6d8376ad4913cbffe0e0c2cca0c4febbe596",
                    "status": "affected",
                    "version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b38cbd4af5034635cff109e08788c63f956f3a69",
                    "status": "affected",
                    "version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "60abb0ac11dccd6b98fd9182bc5f85b621688861",
                    "status": "affected",
                    "version": "b692bf9a7543af7ad11a59d182a3757578f0ba53",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/xdp_sock_drv.h",
                  "net/xdp/xsk.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.13"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "40E7536C-DA22-4B7D-9953-0343B4D9A3E6",
                    "versionEndExcluding": "6.18.17",
                    "versionStartIncluding": "6.13.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3",
                    "versionEndExcluding": "6.19.7",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*",
                    "matchCriteriaId": "5A3F9505-6B98-4269-8B81-127E55A1BF00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Fix fragment node deletion to prevent buffer leak\n\nAfter commit b692bf9a7543 (\"xsk: Get rid of xdp_buff_xsk::xskb_list_node\"),\nthe list_node field is reused for both the xskb pool list and the buffer\nfree list, this causes a buffer leak as described below.\n\nxp_free() checks if a buffer is already on the free list using\nlist_empty(\u0026xskb-\u003elist_node). When list_del() is used to remove a node\nfrom the xskb pool list, it doesn\u0027t reinitialize the node pointers.\nThis means list_empty() will return false even after the node has been\nremoved, causing xp_free() to incorrectly skip adding the buffer to the\nfree list.\n\nFix this by using list_del_init() instead of list_del() in all fragment\nhandling paths, this ensures the list node is reinitialized after removal,\nallowing the list_empty() to work correctly."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxsk: Corrige la eliminaci\u00f3n de nodos de fragmento para prevenir una fuga de b\u00fafer\n\nDespu\u00e9s del commit b692bf9a7543 (\u0027xsk: Elimina xdp_buff_xsk::xskb_list_node\u0027), el campo list_node se reutiliza tanto para la lista de la piscina xskb como para la lista de b\u00faferes libres, esto causa una fuga de b\u00fafer como se describe a continuaci\u00f3n.\n\nxp_free() comprueba si un b\u00fafer ya est\u00e1 en la lista de libres usando list_empty(\u0026amp;xskb-\u0026gt;list_node). Cuando se usa list_del() para eliminar un nodo de la lista de la piscina xskb, no reinicializa los punteros del nodo. Esto significa que list_empty() devolver\u00e1 falso incluso despu\u00e9s de que el nodo haya sido eliminado, causando que xp_free() omita incorrectamente a\u00f1adir el b\u00fafer a la lista de libres.\n\nSoluciona esto usando list_del_init() en lugar de list_del() en todas las rutas de manejo de fragmentos, esto asegura que el nodo de la lista se reinicialice despu\u00e9s de la eliminaci\u00f3n, permitiendo que list_empty() funcione correctamente."
          }
        ],
        "id": "CVE-2026-23326",
        "lastModified": "2026-06-17T10:21:20.023",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-03-25T11:16:29.687",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2a9ea988465ece5b6896b1bdc144170a64e84c35"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/60abb0ac11dccd6b98fd9182bc5f85b621688861"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/645c6d8376ad4913cbffe0e0c2cca0c4febbe596"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b38cbd4af5034635cff109e08788c63f956f3a69"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:20:11+00:00",
      "cve": "CVE-2026-23326",
      "id": "CVE-2026-23326",
      "initial_release_date": "2026-03-25T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xsk: Fix fragment node deletion to prevent buffer leak",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23326.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:37:11Z",
      "cve": "CVE-2026-23326",
      "id": "CVE-2026-23326",
      "initial_release_date": "2026-03-25T16:56:19Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "399",
      "product_status:known_not_affected": "423",
      "product_status:recommended": "172",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23326",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23326.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.