CVE-2026-23331: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23331 is a UDP socket unhashing flaw in the Linux kernel where auto-bound connected sockets are not properly removed from the 4-tuple hash table upon disconnection. When a UDP socket is bound to the wildcard address with a non-zero port, connected to a remote address, and then disconnected, the kernel's __udp_disconnect() incorrectly rehashes the socket rather than removing it, leaving orphaned garbage entries in the hash table chain. This affects Linux kernel versions 6.13.1 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1 through 7.0-rc2. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). When a UDP socket with SOCK_BINDPORT_LOCK set (but not SOCK_BINDADDR_LOCK) is connected via connect(), the kernel calls udp_lib_hash4() to insert it into the 4-tuple hash table. Upon disconnection, __udp_disconnect() invokes sk->sk_prot->rehash(sk), which computes a new hash based on the wildcard address and moves the socket to a new slot — but fails to remove the original entry, leaving a stale, unreachable entry in the hash chain. The fix requires explicitly calling udp_unhash4() to remove the socket from the 4-tuple table during disconnect, and ensuring udp_sk(sk)->udp_portaddr_hash is updated after udp_hash4_dec(hslot2) (Red Hat Bugzilla, Kernel Patch).

Successful exploitation leads to kernel memory resource exhaustion and denial of service. A local unprivileged attacker can repeatedly perform bind/connect/disconnect cycles on UDP sockets, causing orphaned hash table entries to accumulate and consume kernel memory, potentially resulting in system instability or crashes. There is no confidentiality or integrity impact; the vulnerability is limited to availability (DoS) (Red Hat Advisory).

1. Gain local access: Obtain a low-privileged shell on a system running a vulnerable Linux kernel (versions 6.13.1–6.18.16, 6.19–6.19.6, or 7.0-rc1/rc2).
2. Create a UDP socket: Open a UDP socket using socket(AF_INET, SOCK_DGRAM, 0).
3. Bind to wildcard address with a non-zero port: Call bind() with INADDR_ANY and a specific port, setting SOCK_BINDPORT_LOCK on the socket's user locks.
4. Connect the socket: Call connect() with a remote address, causing the kernel to insert the socket into the 4-tuple hash table via udp_lib_hash4().
5. Disconnect the socket: Call connect() with AF_UNSPEC or use disconnect(), triggering __udp_disconnect() which incorrectly rehashes rather than removes the socket, leaving a stale entry.
6. Repeat to exhaust resources: Loop through steps 2–5 rapidly to accumulate orphaned hash table entries, consuming kernel memory until the system becomes unstable or crashes (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg) showing memory allocation warnings or OOM (Out-of-Memory) killer activity related to network subsystem allocations.
• System Metrics: Unusual growth in kernel memory usage (e.g., via /proc/meminfo showing elevated Slab or KernelStack values) without a corresponding increase in active network connections.
• Process Behavior: Processes repeatedly calling bind(), connect(), and disconnect() on UDP sockets in rapid succession, observable via strace or auditd syscall monitoring.
• Network: High number of UDP socket entries in /proc/net/udp or /proc/net/udp6 that do not correspond to active connections.

Upgrade to a patched Linux kernel version: 6.18.17 or later, 6.19.7 or later, or 7.0-rc3 or later. Patch commits are available at git.kernel.org (commits 3b8f104880c1, 6996a2d2d0a6, and b955350778b8). For systems that cannot be immediately patched, restrict local user access, enforce the principle of least privilege, and consider using Linux Security Modules (SELinux or AppArmor) to limit socket creation operations. Monitor kernel memory usage for anomalous growth as a compensating control (Red Hat Advisory, Kernel Patch).