CVE-2026-23331

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23331", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.996Z", "datePublished": "2026-03-25T10:27:22.526Z", "dateUpdated": "2026-05-11T22:04:47.743Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:04:47.743Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.\n\nLet's say we bind() an UDP socket to the wildcard address with a\nnon-zero port, connect() it to an address, and disconnect it from\nthe address.\n\nbind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not\nSOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put\nthe socket into the 4-tuple hash table.\n\nThen, __udp_disconnect() calls sk->sk_prot->rehash(sk).\n\nIt computes a new hash based on the wildcard address and moves\nthe socket to a new slot in the 4-tuple hash table, leaving a\ngarbage in the chain that no packet hits.\n\nLet's remove such a socket from 4-tuple hash table when disconnected.\n\nNote that udp_sk(sk)->udp_portaddr_hash needs to be udpated after\nudp_hash4_dec(hslot2) in udp_unhash4()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/udp.c"], "versions": [{"version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380", "lessThan": "b955350778b8715e1b7885179979b3a68221c0fb", "status": "affected", "versionType": "git"}, {"version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380", "lessThan": "3b8f104880c104151f8c30f2f89df81fb59a286c", "status": "affected", "versionType": "git"}, {"version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380", "lessThan": "6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/udp.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b955350778b8715e1b7885179979b3a68221c0fb"}, {"url": "https://git.kernel.org/stable/c/3b8f104880c104151f8c30f2f89df81fb59a286c"}, {"url": "https://git.kernel.org/stable/c/6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4"}], "title": "udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/udp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b955350778b8715e1b7885179979b3a68221c0fb", "status": "affected", "version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380", "versionType": "git"}, {"lessThan": "3b8f104880c104151f8c30f2f89df81fb59a286c", "status": "affected", "version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380", "versionType": "git"}, {"lessThan": "6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4", "status": "affected", "version": "78c91ae2c6deb5d236a5a93ff2995cdd05514380", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/udp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "40E7536C-DA22-4B7D-9953-0343B4D9A3E6", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*", "matchCriteriaId": "5A3F9505-6B98-4269-8B81-127E55A1BF00", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.\n\nLet's say we bind() an UDP socket to the wildcard address with a\nnon-zero port, connect() it to an address, and disconnect it from\nthe address.\n\nbind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not\nSOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put\nthe socket into the 4-tuple hash table.\n\nThen, __udp_disconnect() calls sk->sk_prot->rehash(sk).\n\nIt computes a new hash based on the wildcard address and moves\nthe socket to a new slot in the 4-tuple hash table, leaving a\ngarbage in the chain that no packet hits.\n\nLet's remove such a socket from 4-tuple hash table when disconnected.\n\nNote that udp_sk(sk)->udp_portaddr_hash needs to be udpated after\nudp_hash4_dec(hslot2) in udp_unhash4()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nudp: Eliminar del hash el sk conectado auto-vinculado de la tabla hash de 4-tuplas cuando se desconecta.\n\nSupongamos que vinculamos (bind()) un socket UDP a la direcci\u00f3n comod\u00edn con un puerto no nulo, lo conectamos (connect()) a una direcci\u00f3n y lo desconectamos de la direcci\u00f3n.\n\nbind() establece SOCK_BINDPORT_LOCK en sk->sk_userlocks (pero no SOCK_BINDADDR_LOCK), y connect() llama a udp_lib_hash4() para colocar el socket en la tabla hash de 4-tuplas.\n\nLuego, __udp_disconnect() llama a sk->sk_prot->rehash(sk).\n\nCalcula un nuevo hash basado en la direcci\u00f3n comod\u00edn y mueve el socket a una nueva ranura en la tabla hash de 4-tuplas, dejando basura en la cadena que ning\u00fan paquete alcanza.\n\nEliminemos dicho socket de la tabla hash de 4-tuplas cuando se desconecta.\n\nTenga en cuenta que udp_sk(sk)->udp_portaddr_hash necesita ser actualizado despu\u00e9s de udp_hash4_dec(hslot2) en udp_unhash4()."}], "id": "CVE-2026-23331", "lastModified": "2026-06-17T10:21:20.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-25T11:16:30.510", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b8f104880c104151f8c30f2f89df81fb59a286c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b955350778b8715e1b7885179979b3a68221c0fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected", "id": "2451190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451190"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's handling of User Datagram Protocol (UDP) sockets. When an auto-bound UDP socket is connected and subsequently disconnected, it may not be properly unhashed from the 4-tuple hash table. This oversight can lead to the accumulation of stale entries, potentially causing resource exhaustion or performance degradation and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-23331", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23331\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23331\nhttps://lore.kernel.org/linux-cve-announce/2026032532-CVE-2026-23331-735b@gregkh/T"], "statement": "This flaw affects UDP socket handling when applications repeatedly connect and disconnect sockets bound to wildcard addresses. The stale hash entries accumulate in the 4-tuple hash table, causing lookup inefficiency and potential hash chain degradation. The impact is gradual performance degradation rather than an immediate system crash.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[78c91ae2c6deb5d236a5a93ff2995cdd05514380,b955350778b8715e1b7885179979b3a68221c0fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[78c91ae2c6deb5d236a5a93ff2995cdd05514380,3b8f104880c104151f8c30f2f89df81fb59a286c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[78c91ae2c6deb5d236a5a93ff2995cdd05514380,6996a2d2d0a64808c19c98002aeb5d9d1b2df6a4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T22:06:30.801972+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that includes the fix for the UDP hash bug.", "Restart network services or reboot the system to clear any stale UDP sockets from the hash table.", "Monitor system logs for WARN or ERR messages related to UDP socket handling to detect potential issues early."], "summary": {"action": "Immediate Patch", "impact": "Kernel integrity or availability due to hash table inconsistency"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Linux kernel in all releases that contain the broken UDP hash handling routine, including current stable kernels and all 7.0 release candidates up to rc7. Systems running any of these kernel versions that have not applied the official patch are vulnerable.", "description_and_impact": "A bug in the Linux kernel allows an automatically bound UDP socket to remain in the 4\u2011tuple hash table after the socket is disconnected. The lingering entry is not removed correctly, creating a garbage reference that may cause incorrect packet routing or kernel memory corruption. The description does not detail direct information leakage or privilege escalation, but the improper hash handling could lead to kernel instability.", "risk_and_exploitability": "The CVSS score of 5.5 places the vulnerability in the moderate severity band, while the EPSS score of less than 1% indicates it is unlikely to be widely exploited. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Due to the kernel and socket nature of the flaw, the attack vector is inferred to be local, requiring the attacker to be able to manipulate UDP sockets on the affected host. Exploitation would potentially cause a kernel crash or reduced network reliability, impacting system availability."}}}}, "created": "2026-03-25T21:32:22.531012+00:00", "updated": "2026-04-28T22:15:41.365602+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}