Junglewise Threat Intelligence

CVE-2026-23095: Linux Kernel memory leak in Generic UDP Encapsulation

CVE-2026-23095 · Severity: high · CVSS 7.5 · Published 2026-02-04

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking component responsible for Generic UDP Encapsulation (GUE). By sending specially crafted network packets, an attacker could cause the system to leak memory, eventually leading to a system crash or service instability. This affects Linux-based systems and certain Siemens industrial controllers that utilize the impacted kernel versions.

Technical details

A memory leak (CWE-401) exists in the gue_udp_recv() function within net/ipv4/fou_core.c (or fou.c in older versions) of the Linux kernel. The vulnerability is triggered when a GUE packet is received with an inner protocol type of 0 (IPv6 Hop-by-Hop Option). The function returns a value that fails to trigger the 'resubmit' logic in ip_protocol_deliver_rcu() for protocol 0, resulting in the socket buffer (skb) not being freed. A remote, unauthenticated attacker can exploit this by sending a stream of such packets to exhaust system memory, leading to a denial of service. The fix involves explicitly dropping packets where the inner protocol type is 0.

Affected products

  • Linux Linux Kernel 37dd0247797b1 to 9a56796ad258786d3624eef5aefba394fc9bdded
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-01-15: patched: Initial patch authored by Kuniyuki Iwashima
  • 2026-02-04: advisory: CVE published
  • 2026-07-14: advisory: Siemens product advisory added

References

Related threats