CVE-2026-23386: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23386 is an out-of-bounds array access vulnerability in the Linux kernel's GVE (Google Virtual Ethernet) driver affecting the gve_tx_clean_pending_packets() function in DQ-QPL mode. The flaw was published on March 25, 2026, and affects Linux kernel versions 6.6.1–6.6.129, 6.7–6.12.77, 6.13–6.18.16, 6.19.0–6.19.6, and pre-release 7.0-rc1 through 7.0-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Red Hat Advisory, Feedly).

The root cause is improper validation of an array index (CWE-1285) in gve_tx_clean_pending_packets() within drivers/net/ethernet/google/gve/gve_tx_dqo.c. In DQ-QPL mode, the function incorrectly follows the RDA buffer cleanup path: it iterates num_bufs times and attempts to unmap entries in the dma array, but the dma array shares storage with tx_qpl_buf_ids via a union, causing buffer IDs to be misinterpreted as DMA addresses. Additionally, num_bufs in QPL mode counts 2K chunks and can significantly exceed the dma array's fixed size of 18 entries, triggering a UBSAN out-of-bounds access at index 18 or higher. The fix requires checking for QPL mode and delegating buffer reclamation to gve_free_tx_qpl_bufs() (Red Hat Advisory, Feedly).

Successful exploitation causes kernel denial of service through out-of-bounds array access and potential memory corruption, manifesting during network interface close or reset operations (e.g., via gve_close() → gve_reset() → gve_service_task()). The vulnerability is limited to availability impact — there is no confidentiality or integrity compromise — but kernel crashes and system instability can affect workloads running on Google Cloud instances using the GVE driver. Lateral movement is not a direct risk, though system instability could disrupt dependent services (Red Hat Advisory, Feedly).

• Logs: Kernel log entries containing UBSAN: array-index-out-of-bounds in drivers/net/ethernet/google/gve/gve_tx_dqo.c:178:5 with messages such as index 18 is out of range for type 'dma_addr_t[18]'.
• Logs: Kernel call traces referencing gve_tx_stop_ring_dqo, gve_close, gve_reset, and gve_service_task in the workqueue context.
• Process: Unexpected kernel workqueue activity (gve gve_service_task) coinciding with network interface resets or shutdowns on GVE-enabled systems.

Apply the patched kernel versions released for each affected branch: 6.6.130, 6.12.78, 6.18.17, 6.19.7, and 7.0-rc2 (or later). Upstream fixes are available via the following kernel.org commits: 07e0c80e, 3744ebd8, 71511dae, c171f90f, and fb868db5. Distribution-specific patches have been issued by SUSE (SUSE-SU-2026:1661-1, SUSE-SU-2026:1668-1) and Debian (linux 6.12.85). As a temporary workaround for systems that cannot be patched immediately, avoid triggering network interface resets or shutdowns on systems using the GVE driver, and monitor kernel logs for UBSAN out-of-bounds warnings (Red Hat Advisory, SUSE Advisory, Feedly).

Red Hat assigned a Medium severity rating and tracked the issue via Bugzilla (bug #2451273). SUSE issued security updates (SUSE-SU-2026:1661-1 and SUSE-SU-2026:1668-1) addressing this CVE among others. Debian accepted the fix into stable-security and proposed-updates. The vulnerability received routine coverage from Linux security aggregators such as linuxsecurity.com and pro-linux.de, with no notable researcher commentary or broader media attention beyond standard advisory distribution (Red Hat Advisory, SUSE Advisory).