CVE-2026-23378: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23378 is a memory corruption vulnerability in the Linux kernel's net/sched subsystem, specifically in the act_ife (Intermediate Functional Element) action module. The flaw arises from incorrect metalist update behavior: when an IFE action replace operation changes the metalist, the code appends new metadata instead of replacing the existing data, leading to unbounded metadata accumulation and a slab-out-of-bounds write during the encode operation. Affected kernel versions include 4.15.1 through 6.1.167, 6.2 through 6.6.130, 6.7 through 6.12.77, 6.13 through 6.18.17, 6.19 through 6.19.7, and release candidates for 7.0 (rc1–rc7). It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input). In net/sched/act_ife.c, when an IFE action replace operation modifies the metalist, the implementation incorrectly appends new metadata entries rather than replacing the old ones. Over repeated replace operations, this causes unbounded growth of the metalist, eventually triggering a KASAN-detected slab-out-of-bounds write in ife_tlv_meta_encode (net/ife/ife.c:168) during the encode operation. Exploitation requires local access with low privileges (e.g., the ability to configure traffic control actions via tc), and no user interaction is needed. The fix resolves the issue by properly integrating the metalist into the IFE RCU data structure to enforce correct replace semantics (Red Hat Bugzilla).

Successful exploitation can result in high confidentiality, integrity, and availability impacts on the affected system. An attacker with local, low-privilege access can trigger kernel memory corruption, potentially leading to kernel panic (denial of service), information disclosure from kernel memory, or arbitrary code execution in kernel context. The vulnerability is confined to the local system (scope unchanged), but kernel-level compromise could enable privilege escalation and lateral movement within a multi-tenant or containerized environment (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). The EPSS score is approximately 0.024% (0.000240), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection plugins are available from Nessus (IDs: 303684, 311783, 317729, 318102, 318240, 319659) and Qualys (IDs: 762889, 762916, 762925).

1. Gain local access: Obtain a local user account on a system running a vulnerable Linux kernel version (4.15.1–6.1.167, 6.2–6.6.130, 6.7–6.12.77, 6.13–6.18.17, or 6.19–6.19.7).
2. Verify tc/IFE support: Confirm that the act_ife kernel module is loaded or loadable (lsmod | grep act_ife; load with modprobe act_ife if permitted).
3. Create an IFE action: Use the tc (traffic control) utility to create an IFE action with an initial metalist: tc actions add action ife encode allow mark index 1.
4. Repeatedly replace the metalist: Issue multiple tc actions replace commands that modify the metalist, causing the kernel to append rather than replace metadata entries: tc actions replace action ife encode allow mark index 1 (repeat many times).
5. Trigger the encode operation: Send network traffic through the configured qdisc/filter that invokes the IFE action, causing ife_tlv_meta_encode to write beyond the allocated slab buffer, resulting in kernel memory corruption, panic, or potential code execution (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode or Write of size 4 at addr entries; kernel panic traces referencing tcf_ife_act, ife_encode_meta_u16, or ife_tlv_meta_encode.
• Process: Unusual processes repeatedly invoking tc actions replace with IFE action parameters; processes named similarly to ife_out_out_bou (as seen in the KASAN report).
• Network: Unexpected or repeated tc (traffic control) configuration changes on network interfaces, particularly involving IFE encode actions with metalist modifications.
• File System: Presence of scripts or binaries automating repeated tc actions replace commands targeting IFE actions (Red Hat Bugzilla).

Apply the upstream kernel patches available via stable kernel commits (e.g., 56ade7ddea6c, 5b1449301ca0, 691866c4cca5, 91a89d3bdc2f, cd888c396667, e2cedd400c3e) targeting the affected version branches (git.kernel.org). Distribution-specific updates are available from Red Hat, SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian (DSA-6243-1, DLA-4561-1), and openSUSE. As a workaround where patching is not immediately possible, restrict local user access to network scheduling configuration interfaces (e.g., limit CAP_NET_ADMIN capability) and prevent loading of the act_ife kernel module via module blacklisting (echo 'blacklist act_ife' >> /etc/modprobe.d/blacklist.conf) if IFE functionality is not required.