CVE-2026-23016: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23016 is a denial-of-service vulnerability in the Linux kernel caused by improper netfilter conntrack reference handling in fragmented packets. The flaw resides in the inet: frags subsystem, where socket buffers (skbs) in fragment lists retain nf_conn references that are not properly released during defragmentation and reassembly operations. It affects Linux kernel versions 6.18.1 through 6.18.5 (fixed in 6.18.6) and release candidates 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource management (CWE-404) in the Linux kernel's IP fragment reassembly engine. When a network namespace emits fragmented packets, nf_defrag_v6_hook reassembles them and attaches an nf_conn reference to the reassembled skb. Upon refragmentation via ip6_fragment, ip6_copy_metadata() propagates the nf_conn reference to each fragment. On the input path, ipv6_frag_rcv() reassembles these fragments into a new skb whose frag_list entries still hold individual nf_conn references. Because skb_release_head_state() does not traverse the frag_list, and nf_reset_ct() similarly does not iterate frag_list skbs, these references are never released, blocking conntrack cleanup. The issue became reproducible via the ip_defrag.sh selftest after commit 6471658dc66c ("udp: use skb_attempt_defer_free()"), but the underlying problem can also affect TCP when PMTU discovery is disabled (Red Hat Bugzilla).

Successful exploitation causes conntrack cleanup operations to hang indefinitely — observed hangs exceed 60 seconds — preventing the nf_conntrack module from being properly removed from memory and blocking network namespace teardown. This results in a local denial-of-service condition affecting system stability and resource management, particularly under UDP fragmentation/reassembly scenarios or TCP without PMTU discovery. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel warning messages in dmesg or system logs referencing net/netfilter/nf_conntrack_core.c:2512; log entries containing "conntrack cleanup blocked for 60s".
• System Behavior: Network namespace teardown operations hanging for 60+ seconds; nf_conntrack module unable to be unloaded (rmmod stalling or failing).
• Network: Unusual accumulation of fragmented UDP or IPv6 packets in environments where PMTU discovery is disabled for TCP.

The upstream Linux kernel patch resolves the issue by dropping nf_conn entries when skbs are placed in the defrag queue, while preserving the nf_conn entry of the first (offset 0) skb so the reassembled skb retains its conntrack entry for the TX path. Patches are available at the stable kernel tree commits 088ca99dbb039c444c3ff987c5412a73f4f0cbf8 and 2ef02ac38d3c17f34a00c4b267d961a8d4b45d1a; upgrade to kernel 6.18.6 or later. As an immediate workaround, administrators can set net.core.skb_defer_max=0 (e.g., via sysctl -w net.core.skb_defer_max=0) to prevent the hang, though this addresses the symptom rather than the root cause (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).