Junglewise Threat Intelligence

CVE-2026-23378: Linux Kernel out-of-bounds write in net/sched act_ife

CVE-2026-23378 · Severity: high · CVSS 7.8 · Published 2026-03-25

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking subsystem that affects how certain network traffic metadata is handled. When updating specific network actions, the system incorrectly accumulates data instead of replacing it, which can lead to a system crash or memory corruption. This could allow a local user to disrupt network services or potentially gain unauthorized access to sensitive system memory.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the Linux kernel's 'act_ife' (Inter-FE action) module within the traffic control (tc) subsystem. The root cause is in the 'metalist' update behavior: when an IFE action is replaced, the code appends new metadata instead of replacing the existing entries. This leads to an unbounded list that eventually causes a slab-out-of-bounds error in 'ife_tlv_meta_encode' during the encoding operation. A local attacker with permissions to modify network traffic control actions can exploit this to cause a kernel panic (DoS) or potentially achieve privilege escalation through memory corruption. The fix involves moving the metalist to the RCU-protected data structure to ensure proper replacement during updates.

Affected products

  • Linux Linux Kernel 7.0.0-rc1-00169-gfbdfa8da05b6
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-04: other: Initial patch authored
  • 2026-03-25: advisory: Vulnerability disclosed and published
  • 2026-03-25: patched: Patches committed to stable kernel trees

References

Related threats