---
id: CVE-2026-23204
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: cls_u32: use skb_header_pointer_careful()

  skb_header_pointer() does not fully validate negative @offset values.

  Use skb_header_pointer_careful() instead.

  …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: cls_u32: use skb_header_pointer_careful()

  skb_header_pointer() does not fully validate negative @offset values.

  Use skb_header_pointer_careful() instead.

  …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.35.1, < 6.6.124'
  - 'linux_kernel >= 6.7, < 6.12.70'
  - 'linux_kernel >= 6.13, < 6.18.10'
  - linux_kernel = 2.6.35
  - linux_kernel = 6.19
patched:
  - linux_kernel 6.18.10
published: '2026-02-14'
updated: '2026-07-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23204'
references:
  - url: 'https://git.kernel.org/stable/c/13336a6239b9d7c6e61483017bb8bdfe3ceb10a5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/29681ed51e737be14d18ecd1c304c57002e4b72c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/66e4b63d61c15de6ca5332d9ca6db59a404d7136'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8a672f177ebe19c93d795fbe967846084fbc7943'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cabd1a976375780dabab888784e356f574bbaed8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfa745830e45ecb75c061aa34330ee0cac941cc7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e41a23e61259f5526af875c3b86b3d42a9bae0e5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00127
epssPercentile: 0.01991
ingestedAt: '2026-07-04T12:56:09.277Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-16T20:32:50.609345Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221

## Affected

- `linux_kernel >= 2.6.35.1, < 6.6.124`
- `linux_kernel >= 6.7, < 6.12.70`
- `linux_kernel >= 6.13, < 6.18.10`
- `linux_kernel = 2.6.35`
- `linux_kernel = 6.19`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.18.10`