CVE-2026-23326xsk: Fix fragment node deletion to prevent buffer leak
- 7.8HighCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix fragment node deletion to prevent buffer leak After commit b692bf9a7543 ("xsk: Get rid of xdp_buff_xsk::xskb_list_node"), the list_node field is reused for both the xskb pool list and the buffer free list, this causes a buffer leak as described below. xp_free() checks if a buffer is already on the free list using list_empty(&xskb->list_node). When list_del() is used to remove a node from the xskb pool list, it doesn't reinitialize the node pointers. This means list_empty() will return false even after the node has been removed, causing xp_free() to incorrectly skip adding the buffer to the free list. Fix this by using list_del_init() instead of list_del() in all fragment handling paths, this ensures the list node is reinitialized after removal, allowing the list_empty() to work correctly.
Timeline
ID reserved
By Linux
- 2 months later
· 2 months later
Published
- 47 days later
· 47 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 560c974b7ccd95bb9ff20df77f6654283e45c9c6 – < 5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d
- affected fd5614763805d6f386bd07cc53558f88b1b1eb62 – < 2a9ea988465ece5b6896b1bdc144170a64e84c35
- affected b692bf9a7543af7ad11a59d182a3757578f0ba53 – < 645c6d8376ad4913cbffe0e0c2cca0c4febbe596
- affected b692bf9a7543af7ad11a59d182a3757578f0ba53 – < b38cbd4af5034635cff109e08788c63f956f3a69
- affected b692bf9a7543af7ad11a59d182a3757578f0ba53 – < 60abb0ac11dccd6b98fd9182bc5f85b621688861
- affected 6.13
- unaffected < 6.13
- unaffected 6.18.17 – ≤ 6.18.*
- unaffected 6.19.7 – ≤ 6.19.*
- unaffected 7.0 – ≤ *
References
References5
- https://git.kernel.org/stable/c/5172adf9efb8298a52f4dcdc3f98d4d9d1e06a6d (opens in a new tab)
- https://git.kernel.org/stable/c/2a9ea988465ece5b6896b1bdc144170a64e84c35 (opens in a new tab)
- https://git.kernel.org/stable/c/645c6d8376ad4913cbffe0e0c2cca0c4febbe596 (opens in a new tab)
- https://git.kernel.org/stable/c/b38cbd4af5034635cff109e08788c63f956f3a69 (opens in a new tab)
- https://git.kernel.org/stable/c/60abb0ac11dccd6b98fd9182bc5f85b621688861 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-15279 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-23326)Record last updated .