CVE-2026-23445

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23445", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.019Z", "datePublished": "2026-04-03T15:15:29.194Z", "dateUpdated": "2026-10-19T18:35:44.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:48.746Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: fix page fault in XDP TX timestamps handling\n\nIf an XDP application that requested TX timestamping is shutting down\nwhile the link of the interface in use is still up the following kernel\nsplat is reported:\n\n[ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008\n...\n[ 883.803650] [ T1554] Call Trace:\n[ 883.803652] [ T1554] <TASK>\n[ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc]\n[ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc]\n...\n\nDuring shutdown of the TX ring the xsk_meta pointers are left behind, so\nthat the IRQ handler is trying to touch them.\n\nThis issue is now being fixed by cleaning up the stale xsk meta data on\nTX shutdown. TX timestamps on other queues remain unaffected."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local AF_XDP socket setup/transmit plus SIOCSHWTSTAMP/ioctl configuration on an igc netdev. Remote network packets alone do not create the stale XSK TX timestamp request or trigger XSK pool teardown.\nAC:L - The attacker controls the relevant sequence: enable TX timestamping, submit an AF_XDP zero-copy packet with TX metadata, and shut down the XDP socket while the link remains up. The timing window is between attacker-controlled TX/shutdown and the hardware timestamp IRQ, and can be retried.\nPR:L - The path requires CAP_NET_RAW for PF_XDP and CAP_NET_ADMIN for hardware timestamp configuration in the target network namespace. These are namespace/container capabilities rather than necessarily init-namespace root, so the highest reasonable scoring is Low privileges.\nUI:N - No victim interaction is required after the attacker has local access and the needed namespace capabilities. The attacker can perform the socket setup, transmit, and shutdown sequence directly.\nS:U - The impact is within the local kernel and its managed networking resources. This is a standard kernel memory-safety/DoS issue, not a VM escape or separate security authority boundary crossing.\nC:H - The bug leaves stale AF_XDP TX metadata and buffer pointers in the igc timestamp request array; the IRQ completion path can dereference/write through those stale pointers after teardown. As a stale-pointer memory corruption/UAF-style condition, exploitation could plausibly lead to broader kernel memory disclosure if converted into code execution.\nI:H - The timestamp completion path can perform a write through stale metadata pointers, and cleanup can touch stale TX buffer state. Under the required conservative kernel scoring, this memory corruption is treated as potentially enabling kernel control-flow or data integrity compromise.\nA:H - The documented failure is a kernel page fault/oops in igc_ptp_tx_tstamp_event after XDP application shutdown. A local attacker can repeatedly trigger the condition, causing high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c"], "versions": [{"version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "5e4c90c94eb766d70e30694b7fe66862aabaf24b", "status": "affected", "versionType": "git"}, {"version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "31521c124e6488c4a81658e35199feb75a988d86", "status": "affected", "versionType": "git"}, {"version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "b02fa17d1744d19cd3820bdbf6ec5d85547977bf", "status": "affected", "versionType": "git"}, {"version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "45b33e805bd39f615d9353a7194b2da5281332df", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5e4c90c94eb766d70e30694b7fe66862aabaf24b"}, {"url": "https://git.kernel.org/stable/c/31521c124e6488c4a81658e35199feb75a988d86"}, {"url": "https://git.kernel.org/stable/c/b02fa17d1744d19cd3820bdbf6ec5d85547977bf"}, {"url": "https://git.kernel.org/stable/c/45b33e805bd39f615d9353a7194b2da5281332df"}], "title": "igc: fix page fault in XDP TX timestamps handling", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23445", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:08:12.258669Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T18:35:44.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23445", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:08:12.258669Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:08:12.963Z"}}], "cna": {"title": "igc: fix page fault in XDP TX timestamps handling", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local AF_XDP socket setup/transmit plus SIOCSHWTSTAMP/ioctl configuration on an igc netdev. Remote network packets alone do not create the stale XSK TX timestamp request or trigger XSK pool teardown.\nAC:L - The attacker controls the relevant sequence: enable TX timestamping, submit an AF_XDP zero-copy packet with TX metadata, and shut down the XDP socket while the link remains up. The timing window is between attacker-controlled TX/shutdown and the hardware timestamp IRQ, and can be retried.\nPR:L - The path requires CAP_NET_RAW for PF_XDP and CAP_NET_ADMIN for hardware timestamp configuration in the target network namespace. These are namespace/container capabilities rather than necessarily init-namespace root, so the highest reasonable scoring is Low privileges.\nUI:N - No victim interaction is required after the attacker has local access and the needed namespace capabilities. The attacker can perform the socket setup, transmit, and shutdown sequence directly.\nS:U - The impact is within the local kernel and its managed networking resources. This is a standard kernel memory-safety/DoS issue, not a VM escape or separate security authority boundary crossing.\nC:H - The bug leaves stale AF_XDP TX metadata and buffer pointers in the igc timestamp request array; the IRQ completion path can dereference/write through those stale pointers after teardown. As a stale-pointer memory corruption/UAF-style condition, exploitation could plausibly lead to broader kernel memory disclosure if converted into code execution.\nI:H - The timestamp completion path can perform a write through stale metadata pointers, and cleanup can touch stale TX buffer state. Under the required conservative kernel scoring, this memory corruption is treated as potentially enabling kernel control-flow or data integrity compromise.\nA:H - The documented failure is a kernel page fault/oops in igc_ptp_tx_tstamp_event after XDP application shutdown. A local attacker can repeatedly trigger the condition, causing high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "5e4c90c94eb766d70e30694b7fe66862aabaf24b", "versionType": "git"}, {"status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "31521c124e6488c4a81658e35199feb75a988d86", "versionType": "git"}, {"status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "b02fa17d1744d19cd3820bdbf6ec5d85547977bf", "versionType": "git"}, {"status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "lessThan": "45b33e805bd39f615d9353a7194b2da5281332df", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5e4c90c94eb766d70e30694b7fe66862aabaf24b"}, {"url": "https://git.kernel.org/stable/c/31521c124e6488c4a81658e35199feb75a988d86"}, {"url": "https://git.kernel.org/stable/c/b02fa17d1744d19cd3820bdbf6ec5d85547977bf"}, {"url": "https://git.kernel.org/stable/c/45b33e805bd39f615d9353a7194b2da5281332df"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: fix page fault in XDP TX timestamps handling\n\nIf an XDP application that requested TX timestamping is shutting down\nwhile the link of the interface in use is still up the following kernel\nsplat is reported:\n\n[ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008\n...\n[ 883.803650] [ T1554] Call Trace:\n[ 883.803652] [ T1554] <TASK>\n[ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc]\n[ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc]\n...\n\nDuring shutdown of the TX ring the xsk_meta pointers are left behind, so\nthat the IRQ handler is trying to touch them.\n\nThis issue is now being fixed by cleaning up the stale xsk meta data on\nTX shutdown. TX timestamps on other queues remain unaffected."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:21:48.746Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23445", "state": "PUBLISHED", "dateUpdated": "2026-10-19T18:35:44.084Z", "dateReserved": "2026-01-13T15:37:46.019Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-03T15:15:29.194Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5e4c90c94eb766d70e30694b7fe66862aabaf24b", "status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "versionType": "git"}, {"lessThan": "31521c124e6488c4a81658e35199feb75a988d86", "status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "versionType": "git"}, {"lessThan": "b02fa17d1744d19cd3820bdbf6ec5d85547977bf", "status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "versionType": "git"}, {"lessThan": "45b33e805bd39f615d9353a7194b2da5281332df", "status": "affected", "version": "15fd021bc4270273d8f4b7f58fdda8a16214a377", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/intel/igc/igc.h", "drivers/net/ethernet/intel/igc/igc_main.c", "drivers/net/ethernet/intel/igc/igc_ptp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC42FFE4-BBBB-48E5-AD62-DA7FEAD2DD43", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.10.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*", "matchCriteriaId": "9EA80796-744E-45F5-8632-2AB4F7889FCD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: fix page fault in XDP TX timestamps handling\n\nIf an XDP application that requested TX timestamping is shutting down\nwhile the link of the interface in use is still up the following kernel\nsplat is reported:\n\n[ 883.803618] [ T1554] BUG: unable to handle page fault for address: ffffcfb6200fd008\n...\n[ 883.803650] [ T1554] Call Trace:\n[ 883.803652] [ T1554] <TASK>\n[ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc]\n[ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc]\n...\n\nDuring shutdown of the TX ring the xsk_meta pointers are left behind, so\nthat the IRQ handler is trying to touch them.\n\nThis issue is now being fixed by cleaning up the stale xsk meta data on\nTX shutdown. TX timestamps on other queues remain unaffected."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nigc: corregir fallo de p\u00e1gina en el manejo de marcas de tiempo TX de XDP\n\nSi una aplicaci\u00f3n XDP que solicit\u00f3 el sellado de tiempo TX se est\u00e1 apagando mientras el enlace de la interfaz en uso todav\u00eda est\u00e1 activo, se informa del siguiente 'kernel splat':\n\n[ 883.803618] [ T1554] ERROR: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: ffffcfb6200fd008\n...\n[ 883.803650] [ T1554] Traza de Llamada:\n[ 883.803652] [ T1554] <TASK>\n[ 883.803654] [ T1554] igc_ptp_tx_tstamp_event+0xdf/0x160 [igc]\n[ 883.803660] [ T1554] igc_tsync_interrupt+0x2d5/0x300 [igc]\n...\n\nDurante el apagado del anillo TX, los punteros xsk_meta se quedan atr\u00e1s, de modo que el gestor IRQ est\u00e1 intentando tocarlos.\n\nEste problema ahora se est\u00e1 solucionando limpiando los metadatos xsk obsoletos durante el apagado del TX. Las marcas de tiempo TX en otras colas permanecen inafectadas."}], "id": "CVE-2026-23445", "lastModified": "2026-10-19T19:17:48.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23445", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:08:12.258669Z", "version": "2.0.3"}}]}, "published": "2026-04-03T16:16:30.077", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/31521c124e6488c4a81658e35199feb75a988d86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45b33e805bd39f615d9353a7194b2da5281332df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e4c90c94eb766d70e30694b7fe66862aabaf24b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b02fa17d1744d19cd3820bdbf6ec5d85547977bf"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: igc: fix page fault in XDP TX timestamps handling", "id": "2454804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454804"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["A flaw was found in the Linux kernel's igc network driver. When an XDP (eXpress Data Path) application that requests transmit (TX) timestamping is shut down while the network interface link remains active, the driver fails to properly clear stale `xsk_meta` pointers. This improper cleanup can lead to a page fault, potentially causing a system crash and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-23445", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23445\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23445\nhttps://lore.kernel.org/linux-cve-announce/2026040315-CVE-2026-23445-d003@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15fd021bc4270273d8f4b7f58fdda8a16214a377,5e4c90c94eb766d70e30694b7fe66862aabaf24b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15fd021bc4270273d8f4b7f58fdda8a16214a377,31521c124e6488c4a81658e35199feb75a988d86)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15fd021bc4270273d8f4b7f58fdda8a16214a377,b02fa17d1744d19cd3820bdbf6ec5d85547977bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[15fd021bc4270273d8f4b7f58fdda8a16214a377,45b33e805bd39f615d9353a7194b2da5281332df)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-04-03T21:13:53.002078+00:00", "updated": "2026-10-19T21:45:04.261663+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}