# CVE-2026-23378: Linux Kernel out-of-bounds write in net/sched act_ife

Source: https://junglewise.ai/threats/cve-2026-23378-linux-kernel-out-of-bounds-write-in-net-sched-act-ife  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-23378 · Severity: high · CVSS 7.8 · Published 2026-03-25

A vulnerability exists in the Linux kernel's networking subsystem that affects how certain network traffic metadata is handled. When updating specific network actions, the system incorrectly accumulates data instead of replacing it, which can lead to a system crash or memory corruption. This could allow a local user to disrupt network services or potentially gain unauthorized access to sensitive system memory.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518f-4-pn-dp-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-23378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23378 being exploited in the wild.

**How severe is CVE-2026-23378?** High severity, with a CVSS score of 7.8, published 25 March 2026.

**Which products and versions are affected?** Linux Kernel 7.0.0-rc1-00169-gfbdfa8da05b6; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6.

**Is there a fix for CVE-2026-23378?** A patch was published on 2026-03-25: Patches committed to stable kernel trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23378 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-23378?** Check whether you run Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the Linux kernel's 'act_ife' (Inter-FE action) module within the traffic control (tc) subsystem. The root cause is in the 'metalist' update behavior: when an IFE action is replaced, the code appends new metadata instead of replacing the existing entries. This leads to an unbounded list that eventually causes a slab-out-of-bounds error in 'ife_tlv_meta_encode' during the encoding operation. A local attacker with permissions to modify network traffic control actions can exploit this to cause a kernel panic (DoS) or potentially achieve privilege escalation through memory corruption. The fix involves moving the metalist to the RCU-protected data structure to ensure proper replacement during updates.

## Affected products

- Linux Linux Kernel 7.0.0-rc1-00169-gfbdfa8da05b6
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

## Timeline

- 2026-03-04: other: Initial patch authored
- 2026-03-25: advisory: Vulnerability disclosed and published
- 2026-03-25: patched: Patches committed to stable kernel trees

## References

- [https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861](https://git.kernel.org/stable/c/56ade7ddea6ce605552341785d08e365c3f61861)
- [https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee](https://git.kernel.org/stable/c/5b1449301ca070814d866990b46f48d3f39ea4ee)
- [https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947](https://git.kernel.org/stable/c/691866c4cca54dc4df762276b49e89b36e046947)
- [https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b](https://git.kernel.org/stable/c/91a89d3bdc2f63d983adc13d1771631663c5dc1b)
- [https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a](https://git.kernel.org/stable/c/cd888c3966672239f2e0707b846a5a936ac9038a)
- [https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23](https://git.kernel.org/stable/c/e2cedd400c3ec0302ffca2490e8751772906ac23)
- [https://cert-portal.siemens.com/productcert/html/ssa-019113.html](https://cert-portal.siemens.com/productcert/html/ssa-019113.html)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)