CVE-2026-23326
published 2026-03-25CVE-2026-23326: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"),
the list_node field is reused for both the xskb pool list and the buffer
free list, this causes a buffer leak as described below.
xp_free() checks if a buffer is already on the free list using
list_empty(&xskb->list_node). When list_del() is used to remove a node
from the xskb pool list, it doesn't reinitialize the node pointers.
This means list_empty() will return false even after the node has been
removed, causing xp_free() to incorrectly skip adding the buffer to the
free list.
Fix this by using list_del_init() instead of list_del() in all fragment
handling paths, this ensures the list node is reinitialized after removal,
allowing the list_empty() to work correctly.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 560c974b7ccd95bb9ff20df77f6654283e45c9c6 < 5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d | 5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d |
| linux | linux | >= b692bf9a7543af7ad11a59d182a3757578f0ba53 < 645c6d8376ad4913cbffe0e0c2cca0c4febbe596 | 645c6d8376ad4913cbffe0e0c2cca0c4febbe596 |
| linux | linux | >= b692bf9a7543af7ad11a59d182a3757578f0ba53 < b38cbd4af5034635cff109e08788c63f956f3a69 | b38cbd4af5034635cff109e08788c63f956f3a69 |
| linux | linux | >= b692bf9a7543af7ad11a59d182a3757578f0ba53 < 60abb0ac11dccd6b98fd9182bc5f85b621688861 | 60abb0ac11dccd6b98fd9182bc5f85b621688861 |
| linux | linux | >= fd5614763805d6f386bd07cc53558f88b1b1eb62 < 2a9ea988465ece5b6896b1bdc144170a64e84c35 | 2a9ea988465ece5b6896b1bdc144170a64e84c35 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.13.1 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.18.16/6.19.6/7.0-rc2 xsk xp_free initialization (Nessus ID 303743 / WID-SEC-2026-0861)
vuldb·2026-06-17·CVSS 7.8
CVE-2026-23326 [HIGH] Linux Kernel up to 6.18.16/6.19.6/7.0-rc2 xsk xp_free initialization (Nessus ID 303743 / WID-SEC-2026-0861)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.18.16/6.19.6/7.0-rc2. Affected is the function xp_free of the component xsk. The manipulation leads to improper initialization.
This vulnerability is listed as CVE-2026-23326. The attack must be carried out from within the local network. There is no available exploit.
You should upgrade the affected component.
OSV
CVE-2026-23326: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 (
osv·2026-03-25
CVE-2026-23326 CVE-2026-23326: In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 (
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node
OSV
xsk: Fix fragment node deletion to prevent buffer leak
osv·2026-03-25
CVE-2026-23326 xsk: Fix fragment node deletion to prevent buffer leak
xsk: Fix fragment node deletion to prevent buffer leak
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"),
the list_node field is reused for both the xskb pool list and the buffer
free list, this causes a buffer leak as described below.
xp_free() checks if a buffer is already on the free list using
list_empty(&xskb->list_node). When list_del() is used to remove a node
from the xskb pool list, it doesn't reinitialize the node pointers.
This means list_empty() will return false even after the node has been
removed, causing xp_free() to incorrectly skip adding the buffer to the
free list.
Fix this by using list_del_init() instead of list_del()
GHSA
GHSA-6r9h-pc2x-g962: In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543
ghsa_unreviewed·2026-03-25
CVE-2026-23326 GHSA-6r9h-pc2x-g962: In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"),
the list_node field is reused for both the xskb pool list and the buffer
free list, this causes a buffer leak as described below.
xp_free() checks if a buffer is already on the free list using
list_empty(&xskb->list_node). When list_del() is used to remove a node
from the xskb pool list, it doesn't reinitialize the node pointers.
This means list_empty() will return false even after the node has been
removed, causing xp_free() to incorrectly skip adding the buffer to the
free list.
Fix this by using list_del_init() instead of list_del() in all fragment
handling paths, this ensures the list n
Red Hat
kernel: xsk: Fix fragment node deletion to prevent buffer leak
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23326 [LOW] CWE-909 kernel: xsk: Fix fragment node deletion to prevent buffer leak
kernel: xsk: Fix fragment node deletion to prevent buffer leak
In the Linux kernel, the following vulnerability has been resolved:
xsk: Fix fragment node deletion to prevent buffer leak
After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"),
the list_node field is reused for both the xskb pool list and the buffer
free list, this causes a buffer leak as described below.
xp_free() checks if a buffer is already on the free list using
list_empty(&xskb->list_node). When list_del() is used to remove a node
from the xskb pool list, it doesn't reinitialize the node pointers.
This means list_empty() will return false even after the node has been
removed, causing xp_free() to incorrectly skip adding the buffer to the
free list.
Fix this by using list_del_init() instead of list_d
Debian
CVE-2026-23326: linux - In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fr...
vendor_debian·2026
CVE-2026-23326 [LOW] CVE-2026-23326: linux - In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fr...
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2a9ea988465ece5b6896b1bdc144170a64e84c35https://git.kernel.org/stable/c/5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6dhttps://git.kernel.org/stable/c/60abb0ac11dccd6b98fd9182bc5f85b621688861https://git.kernel.org/stable/c/645c6d8376ad4913cbffe0e0c2cca0c4febbe596https://git.kernel.org/stable/c/b38cbd4af5034635cff109e08788c63f956f3a69
2026-03-25
Published