Executive brief
A vulnerability exists in the Linux kernel's Foo-over-UDP (FOU) implementation, a networking feature used to encapsulate various protocols within UDP packets. If misconfigured with an invalid protocol ID, the system may fail to properly manage network memory buffers. This could lead to system instability, resource exhaustion, or potentially allow an attacker to compromise the integrity and availability of the operating system.
Technical details
A vulnerability in the Linux kernel's FOU (Foo-over-UDP) receive path (fou_udp_recv) occurs when the FOU_ATTR_IPPROTO attribute is set to 0. In this scenario, the socket buffer (skb) is neither freed by the receive function nor resubmitted in the RCU protocol delivery path (ip_protocol_deliver_rcu). This results in a resource leak or improper packet handling. The fix involves updating the Netlink policy (fou_nl_policy) to enforce a minimum value of 1 for the IP protocol attribute. The vulnerability is reachable via local Netlink configuration commands.
Affected products
- Linux Linux Kernel 23461551c0062 to 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2026-01-15: other: Patch authored
- 2026-01-30: patched: Patch committed to stable tree
- 2026-02-04: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1cc98b8887cabb1808d2f4a37cd10a7be7574771
- https://git.kernel.org/stable/c/611ef4bd9c73d9e6d87bed57a635ff1fdd8c91ea
- https://git.kernel.org/stable/c/6e983789b7588ee59cbf303583546c043bad8e19
- https://git.kernel.org/stable/c/7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5
- https://git.kernel.org/stable/c/9b75dff8446ec871030d8daf5a69e74f5fe8b956
- https://git.kernel.org/stable/c/b7db31a52c3862a1a32202a273a4c32e7f5f4823
- https://git.kernel.org/stable/c/c7498f9bc390479ccfad7c7f2332237ff4945b03