CVE-2026-23254: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23254 is a Linux kernel vulnerability in the UDP Generic Receive Offload (GRO) completion handler that causes incorrect outer UDP header pseudo checksum computation for encapsulated packets, leading to a denial of service. It was disclosed on March 18, 2026, and affects Linux kernel versions from 6.6.31 to before 6.6.124, 6.9.1 to before 6.12.70, and 6.13 to before 6.18.10, as well as kernel 6.9 and release candidates up to 6.19-rc8. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incorrect assumption in udp4_gro_complete() that the encapsulation flag is always zeroed for packets entering the GRO receive path (CWE-682: Incorrect Calculation). In reality, certain hardware NICs set this flag during hardware checksum offloading for UDP-encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation set, and veth-based network setups can also produce this condition. When the flag is set, udp4_gro_complete() uses the inner network offset instead of the outer offset to compute the outer UDP header pseudo checksum, causing checksum validation failures during subsequent packet processing. The fix clears the encapsulation flag at GRO completion time, allowing udp_gro_complete() to re-set it as needed for genuinely encapsulated packets (Red Hat Bugzilla, Kernel Patch).

Successful exploitation causes checksum validation errors in network packet processing, resulting in degraded or crashed network functionality — a denial of service affecting availability with no confidentiality or integrity impact. A low-privileged local user can trigger the condition through hardware offloading, tun driver packet injection, or a veth-based setup, making it accessible in virtualized and containerized environments. The scope is limited to the affected host's network stack, with no evidence of lateral movement potential (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.6.124 or later (for the 6.6.x LTS branch), 6.12.70 or later (for the 6.12.x branch), 6.18.10 or later (for the 6.13–6.18 range), or 6.19 (stable release). Patches are available via the upstream kernel stable tree. Linux distribution vendors (Red Hat, Ubuntu, etc.) are expected to backport the fix; monitor your vendor's security advisories for updated kernel packages (Red Hat Advisory, Kernel Patch).