CVE-2026-23331: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected. Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and disconnect it from the address. bind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not SOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put the socket into the 4-tuple hash table. Then, __udp_disconnect() calls sk->sk_prot->rehash(sk). It computes a new hash based on the wildcard address and moves the socket to a new slot in the 4-tuple hash table, leaving a garbage in the chain that no packet hits. Let's remove such a socket from 4-tuple hash table when disconnected. Note that udp_sk(sk)->udp_portaddr_hash needs to be udpated after udp_hash4_dec(hslot2) in udp_unhash4().

Засегнати продукти

• Linux Linux: 78c91ae2c6deb5d236a5a93ff2995cdd05514380 преди b955350778b8715e1b7885179979b3a68221c0fb; 78c91ae2c6deb5d236a5a93ff2995cdd05514380 преди 3b8f104880c104151f8c30f2f89df81fb59a286c; 78c91ae2c6deb5d236a5a93ff2995cdd05514380 преди 6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4
• Linux Linux: 6.13; преди 6.13; 6.18.17 до 6.18.*; 6.19.7 до 6.19.*; от 7.0 нататък

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-23331
• https://nvd.nist.gov/vuln/detail/CVE-2026-23331
• https://git.kernel.org/stable/c/b955350778b8715e1b7885179979b3a68221c0fb
• https://git.kernel.org/stable/c/3b8f104880c104151f8c30f2f89df81fb59a286c
• https://git.kernel.org/stable/c/6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4