Skip to content
Heist/ feed
High

net/sched: act_ife: Fix metalist update behavior

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: Fix metalist update behavior Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op: [ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report

Announced Source revision 1
Original source ↗

CVE-2026-23378

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-23378

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
        "lessThan": "56ade7ddea6ce605552341785d08e365c3f61861",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
        "lessThan": "5b1449301ca070814d866990b46f48d3f39ea4ee",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
        "lessThan": "91a89d3bdc2f63d983adc13d1771631663c5dc1b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
        "lessThan": "cd888c3966672239f2e0707b846a5a936ac9038a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
        "lessThan": "691866c4cca54dc4df762276b49e89b36e046947",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "aa9fd9a325d51fa0b11153b03b8fefff569fa955",
        "lessThan": "e2cedd400c3ec0302ffca2490e8751772906ac23",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "include/net/tc_act/tc_ife.h",
      "net/sched/act_ife.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.167",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.130",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.77",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.17",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19.7",
        "versionType": "semver",
        "lessThanOrEqual": "6.19.*"
      },
      {
        "status": "unaffected",
        "version": "7.0",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "include/net/tc_act/tc_ife.h",
      "net/sched/act_ife.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-23378

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#27240 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement