net/sched: act_ife: Fix metalist update behavior
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Fix metalist update behavior Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op: [ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report
CVE-2026-23378
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-23378
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"lessThan": "56ade7ddea6ce605552341785d08e365c3f61861",
"versionType": "git"
},
{
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"lessThan": "5b1449301ca070814d866990b46f48d3f39ea4ee",
"versionType": "git"
},
{
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"lessThan": "91a89d3bdc2f63d983adc13d1771631663c5dc1b",
"versionType": "git"
},
{
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"lessThan": "cd888c3966672239f2e0707b846a5a936ac9038a",
"versionType": "git"
},
{
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"lessThan": "691866c4cca54dc4df762276b49e89b36e046947",
"versionType": "git"
},
{
"status": "affected",
"version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
"lessThan": "e2cedd400c3ec0302ffca2490e8751772906ac23",
"versionType": "git"
}
],
"programFiles": [
"include/net/tc_act/tc_ife.h",
"net/sched/act_ife.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/tc_act/tc_ife.h",
"net/sched/act_ife.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-23378
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #27240 · Revision 1
- Added to Heist Feed
- Publisher date