SB2026032570 - Out-of-bounds write in Linux kernel sched

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026032570

SB2026032570 - Out-of-bounds write in Linux kernel sched

Published: March 25, 2026

Security Bulletin ID SB2026032570
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Out-of-bounds write (CVE-ID: CVE-2026-23378)

The vulnerability allows a local user to execute arbitrary code or cause a denial of service.

The vulnerability exists due to improper memory access in the net/sched: act_ife component when updating metadata lists during packet processing. A local user can send a specially crafted request to trigger out-of-bounds memory write via the ife_tlv_meta_encode function.

Exploitation requires the ability to configure or trigger traffic control (tc) actions within the kernel, which is typically available to local users with sufficient privileges to manipulate network scheduling policies.


Remediation

Install update from vendor's website.

References