CVE-2026-23378
Use-After-Free in Linux Kernel net/sched ife Action Causes OOB Write
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 4.15 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 4.15.1 (inc) to 6.1.167 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's net/sched component, specifically in the act_ife module. The issue arises because when an ife action replace operation modifies the metalist, the current code appends new metadata instead of replacing the old data. This inappropriate behavior can cause an unbounded growth of metadata in the metalist.
This unbounded addition may lead to an out-of-bounds error during the encoding operation, which is detected by the Kernel Address Sanitizer (KASAN) as a slab-out-of-bounds write error.
The fix involves correcting the replace behavior by properly adding the metalist to the ife RCU (Read-Copy-Update) data structure to prevent this unbounded metadata growth.
How can this vulnerability impact me? :
This vulnerability can cause an out-of-bounds memory write in the Linux kernel, which may lead to system instability, crashes, or potential kernel memory corruption.
Such memory corruption issues can be exploited to cause denial of service or potentially escalate privileges if an attacker can trigger the vulnerability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability may cause kernel errors related to the ife action in the Linux kernel, specifically involving the metalist update behavior. Detection can involve monitoring kernel logs for specific error messages.
- Check kernel logs for KASAN slab-out-of-bounds errors related to ife_tlv_meta_encode, for example using: dmesg | grep -i 'ife_tlv_meta_encode'
- Look for BUG reports in kernel logs mentioning 'slab-out-of-bounds' or 'ife_out_out_bou' task names.
- Use journalctl to review recent kernel messages: journalctl -k | grep -i 'ife'
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by correcting the metalist update behavior in the Linux kernel's ife action code. Immediate mitigation involves updating the Linux kernel to a version that includes this fix.
- Apply the latest Linux kernel updates or patches that address the act_ife metalist update issue.
- Avoid using the ife action feature in network scheduling until the fix is applied.
- Monitor kernel logs for related errors to detect any exploitation attempts.