CVE-2026-23326: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23326 is a memory leak vulnerability in the Linux kernel's XSK (AF_XDP Socket) subsystem caused by improper fragment node deletion. Following a code refactoring in commit b692bf9a7543 that reused the list_node field for both the xskb pool list and the buffer free list, use of list_del() instead of list_del_init() leaves list node pointers uninitialized after removal, causing xp_free() to incorrectly skip returning buffers to the free list. Affected versions include Linux kernel 6.13.0 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc7. It was published on March 25, 2026, with patches released in April 2026. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-909 (Missing Initialization of Resource) and CWE-787 (Out-of-bounds Write). After commit b692bf9a7543 eliminated xdp_buff_xsk::xskb_list_node and reused list_node for dual purposes, calling list_del() to remove a node from the xskb pool list does not reinitialize the node's prev/next pointers. As a result, list_empty(&xskb->list_node) returns false even after removal, causing xp_free() to skip adding the buffer back to the free list — producing a persistent kernel memory leak. The fix replaces all list_del() calls with list_del_init() in fragment handling paths, ensuring proper pointer reinitialization (Red Hat CVE, Kernel Patch).

A low-privileged local attacker can exploit this vulnerability to cause a denial of service by repeatedly allocating buffers through the XSK (AF_XDP) subsystem, gradually exhausting kernel memory without triggering proper garbage collection or buffer reuse. This can lead to system instability, performance degradation, and eventual kernel crashes. Confidentiality and integrity impacts are also rated High in the CVSS scoring, though the primary practical risk is availability loss through memory exhaustion on affected systems (Red Hat CVE, Feedly).

Update to patched Linux kernel versions: 6.18.17 or later, 6.19.7 or later, or 7.0-rc3 or later. Stable branch patches are available at git.kernel.org. As a workaround, restrict local system access to trusted users only and disable the XSK subsystem (AF_XDP sockets) if not required for your workload. Monitor kernel memory usage for unexpected growth patterns, particularly on shared or container-based environments with untrusted user access. Amazon Linux 2023 users can apply the update via ALAS2023-2026-1596 (Red Hat CVE, Amazon Linux Advisory, Kernel Patch).