{"cve":"CVE-2026-23204","nvd":{"published":"2026-02-14T17:15:58.297","modified":"2026-10-19T19:17:41.703","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_u32: use skb_header_pointer_careful()\n\nskb_header_pointer() does not fully validate negative @offset values.\n\nUse skb_header_pointer_careful() instead.\n\nGangMin Kim provided a report and a repro fooling u32_classify():\n\nBUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0\nnet/sched/cls_u32.c:221","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","score":7.1},"cwes":["CWE-125"],"references":["https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5","https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c","https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136","https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943","https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2026-23204","score":0.00152,"percentile":0.04344,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}