CVE-2026-23095: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23095 is a memory leak (skb memleak) vulnerability in the Linux kernel's Generic UDP Encapsulation (GUE) handler, triggered when processing GUE packets with an inner IP protocol number of 0. The gue_udp_recv() function fails to properly handle such packets, causing the socket buffer (skb) to not be released, resulting in unreferenced kernel memory objects persisting indefinitely. It was published on February 4, 2026, and affects Linux kernel versions from 3.18 through multiple stable branches up to 6.18.x. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, CVE Record).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In gue_udp_recv(), the function returns -guehdr->proto_ctype to signal a "resubmit" to ip_protocol_deliver_rcu(), but this mechanism only works correctly for non-zero protocol numbers. When a GUE packet carries inner protocol 0 (which maps to IPv6 Hop-by-Hop Option / HOPOPT), the return value of 0 is ambiguous — it is indistinguishable from a "no error" return — causing the packet buffer to be neither freed nor properly resubmitted, resulting in a kernel memory leak. The fix drops packets with inner protocol 0, as encapsulating HOPOPT in GUE is considered impractical. The vulnerability was originally discovered via syzbot fuzzing (Feedly, Kernel Patch).

Successful exploitation causes kernel memory exhaustion through repeated memory leaks, leading to denial of service via system instability or crashes. There is no confidentiality or integrity impact — the vulnerability is limited to availability. An attacker with local access and low privileges can craft and repeatedly send malicious GUE-encapsulated UDP packets with inner protocol 0 to progressively deplete kernel memory resources (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., the ability to send crafted network packets via a TUN device), limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel messages from kmemleak reporting unreferenced objects of size 240 bytes with backtrace referencing gue_udp_recv, ip_protocol_deliver_rcu, or tun_build_skb / __tun_build_skb.
• System Behavior: Gradual increase in kernel memory consumption (/proc/meminfo showing declining MemFree/MemAvailable) without a corresponding increase in user-space process memory usage.
• Network: Unusual UDP traffic destined for GUE-configured ports (default UDP/6080 or custom) containing packets with inner IP protocol field set to 0.
• Process: Presence of a process (e.g., syz.0.x or similar fuzzer artifacts, or a custom tool) repeatedly sending crafted UDP/GUE packets via a TUN interface.

Update the Linux kernel to a patched stable version: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, or 6.18.8. Patch commits are available in the Linux kernel stable repository across seven separate backport commits. Distributions including Ubuntu (USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8275-1, USN-8297-1), SUSE, Oracle Linux, and Amazon Linux 2 have released updated kernel packages. As a temporary workaround, restricting local user access to TUN/TAP devices or GUE-configured interfaces can reduce exposure until patching is feasible (Feedly, Ubuntu USN-8162-1, Amazon ALAS).