CVE-2026-23143: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23143 is a memory structure misalignment vulnerability in the Linux kernel's virtio_net driver, specifically within struct virtnet_info. The flexible array member (FAM) hash_key_data in virtio_net_rss_config_trailer is misaligned by one byte relative to the rss_hash_key_data field, causing the RSS (Receive Side Scaling) key passed to virtualized network devices to be shifted by one byte. This affects Linux kernel versions 6.15 through 6.18.6 and release candidates 6.19-rc1 through 6.19-rc5. It carries a CVSS v3.1 base score of 5.5 (Medium), with availability impact rated High (Feedly).

The root cause is a structural misalignment (CWE-119 / improper memory layout) in struct virtnet_info, where tail padding in struct virtio_net_rss_config_trailer causes rss_trailer.hash_key_data to sit at offset 83 and rss_hash_key_data to sit at offset 84 — a one-byte discrepancy. This misalignment means the RSS hash key transmitted to the virtio network device is shifted by one byte: the last valid byte of the key is dropped and a potentially uninitialized byte is prepended. The fix introduces the TRAILING_OVERLAP() helper, which creates a union between the FAM and the trailing members to enforce correct alignment, validated by a static_assert(). The compiler warning -Wflex-array-member-not-at-end at drivers/net/virtio_net.c:429:46 flags the structural issue (Feedly, Kernel Patch 1).

Exploitation of this vulnerability in virtual environments using the virtio_net driver can result in RSS configuration key corruption, leading to receive-side scaling failures and network traffic distribution anomalies. There is also a potential for limited information disclosure, as an uninitialized byte may replace the last valid byte of the RSS key transmitted to the device. The primary impact is availability degradation of network functionality in virtualized systems; confidentiality and integrity impacts are minimal (Feedly).

Upgrade to Linux kernel version 6.18.7 or later, which includes the fix via the TRAILING_OVERLAP() helper. Patches are available in the stable kernel repositories at git.kernel.org (commits 4156c37 and ae48108). As a temporary workaround on vulnerable versions (6.15–6.18.6, 6.19-rc1–rc5), disabling RSS configuration on virtio_net interfaces may reduce exposure, though this will degrade network performance. Systems running 6.19-rc versions should be treated as vulnerable until the stable release incorporates the fix (Feedly, Kernel Patch 1, Kernel Patch 2).

Coverage has been limited to vulnerability tracking databases and distribution security advisories, including SUSE and Red Hat CVE trackers. The Yocto Project security mailing list also referenced the CVE. No notable researcher commentary or significant social media discussion has been identified (Feedly).