CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO.
In the Linux kernel, the following vulnerability has been resolved:
fou: Don't allow 0 for FOUATTRIPPROTO.
fouudprecv() has the same problem mentioned in the previous patch.
If FOUATTRIPPROTO is set to 0, skb is not freed by fouudprecv() nor "resubmit"-ted in ipprotocoldeliverrcu().
Let's forbid 0 for FOUATTRIPPROTO.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update/fix the kernel so FOU_ATTR_IPPROTO=0 is not allowed ("Let's forbid 0 for FOU_ATTR_IPPROTO" / "fou: Don't allow 0 for FOU_ATTR_IPPROTO").
Linux kernel (fou/fou_udp_recv) FOU_ATTR_IPPROTO = Forbid value 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23083?
CVE-2026-23083 is considered a moderate severity vulnerability because it can lead to resource leaks in the Linux kernel.
How do I fix CVE-2026-23083?
To fix CVE-2026-23083, update your Linux kernel to a version that is patched against this vulnerability.
Which versions of Linux kernel are affected by CVE-2026-23083?
CVE-2026-23083 affects various Linux kernel versions from 3.18 to 6.19-rc6.
What is the nature of the vulnerability CVE-2026-23083?
CVE-2026-23083 is a vulnerability that does not allow the FOU_ATTR_IPPROTO to be set to 0, potentially causing resource not being freed.
Does CVE-2026-23083 affect both production and development environments?
Yes, CVE-2026-23083 can affect both production and development environments using the vulnerable Linux kernel versions.