SB2026032099 - Improper Check for Unusual or Exceptional Conditions in Linux kernel core

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-23254)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the UDP GRO complete stage when handling network packets. A remote attacker can send specially crafted network packets to cause a denial of service.

The issue arises because the udp4_gro_complete() function uses an incorrect network offset to compute the outer UDP header pseudo checksum when the 'encapsulation' flag is set, leading to checksum validation errors and subsequent packet processing failures.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2e5edb69e5d0e23ef248c56fc977039268c77a7b
• https://git.kernel.org/stable/c/5c2c3c38be396257a6a2e55bd601a12bb9781507
• https://git.kernel.org/stable/c/9d40a85138568696387ef04cd004c64612a70874
• https://git.kernel.org/stable/c/b83557bc6f560433fe5d727e241069f8db5ba709