CVE-2026-23378

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.0-rc1-00169-gfbdfa8da05b6

Description The Linux kernel contains a flaw in the net/sched component, specifically within the act ife module. An incorrect metalist update behavior can occur when an ife action is replaced, leading to an unbounded addition of metadata to the metalist. This can potentially cause an out-of-bounds error during the encode operation, as demonstrated by a KASAN report. The issue is related to the ife tlv meta encode function and the ife encode meta u16 function. The tcf ife act function is also involved in the process.

Recommendations Update the Linux kernel to version 7.0.0-rc1-00169-gfbdfa8da05b6 or later.