High 7.1Published Feb 14, 2026

CVE-2026-23204net/sched: cls_u32: use skb_header_pointer_careful()

Updated under an hour ago (Oct 28, 2026, 4:50 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a report and a repro fooling u32_classify(): BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before 66e4b63d61c15de6ca5332d9ca6db59a404d7136; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before 29681ed51e737be14d18ecd1c304c57002e4b72c; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before cfa745830e45ecb75c061aa34330ee0cac941cc7; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before 13336a6239b9d7c6e61483017bb8bdfe3ceb10a5; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before e41a23e61259f5526af875c3b86b3d42a9bae0e5; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before 8a672f177ebe19c93d795fbe967846084fbc7943; from fbc2e7d9cf49e0bf89b9e91fd60a06851a855c5d before cabd1a976375780dabab888784e356f574bbaed8	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.35.1 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 2.6.35; 2.6.35; 2.6.35; 2.6.35; 2.6.35; and 9 more ranges	NVD

References

References

https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136
https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c
https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7
https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5	patch
https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5	patch
https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943	patch
https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.