CVE-2026-23083 Linux CVE debrief

Who should care

System administrators and users of the Linux kernel should be aware of this vulnerability and take necessary actions to update their systems. The vulnerability has a high CVSS score of 7.8, indicating a high level of severity. Users of the Linux kernel should review their systems and apply the necessary patches to mitigate this vulnerability. The vulnerability affects the FOU_ATTR_IPPROTO in the Linux kernel and can be mitigated by updating to the latest kernel version.

Technical summary

The vulnerability is related to the FOU_ATTR_IPPROTO in the Linux kernel. If FOU_ATTR_IPPROTO is set to 0, the skb is not freed by fou_udp_recv() nor 'resubmit'-ted in ip_protocol_deliver_rcu(). This issue has been addressed through multiple patches available in the kernel's stable branches. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The issue affects the Linux kernel and can be mitigated by updating to the latest kernel version. The vulnerability allows an attacker to potentially cause a denial of service or execute arbitrary code.

Defensive priority

High priority should be given to updating the Linux kernel to the latest version, especially for systems that utilize FOU_ATTR_IPPROTO. System administrators should review their systems and apply the necessary patches to mitigate this vulnerability.

Recommended defensive actions

• Update the Linux kernel to the latest version
• Apply the available patches
• Monitor system updates and security advisories
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-02-04T17:16:19.163Z and last modified on 2026-07-14T13:18:23.673Z. The NVD entry is currently Modified. This vulnerability affects the Linux kernel, specifically the FOU_ATTR_IPPROTO. If FOU_ATTR_IPPROTO is set to 0, the skb is not freed by fou_udp_recv() nor 'resubmit'-ted in ip_protocol_deliver_rcu(). The issue has been addressed through multiple patches available in the kernel's stable branches. Users are advised to update to the latest kernel version to mitigate this vulnerability. The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.