7.8

CVE-2026-23083: linux Improper Input Validation

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2026-23083DEBIAN-CVE-2026-23083
Published 04-02-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-23083 is a high (CVSS 7.8) Improper Input Validation vulnerability in linux. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4.1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.15%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 45 · Related 39
DLA-4475-1DLA-4476-1DSA-6126-1DSA-6127-1MGASA-2026-0097MGASA-2026-0098

Timeline

  1. 04-02-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: fou: Don't allow 0 for FOU_ATTR_IPPROTO. fou_udp_recv() has the same problem mentioned in the previous patch. If FOU_ATTR_IPPROTO is set to 0, skb is not freed by fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu(). Let's forbid 0 for FOU_ATTR_IPPROTO.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

+0.02 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu156 products
  • linuxAll versions (No fix recorded) | < 5.15.0-176.186 | < 6.8.0-117.117
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1105.112 | < 6.8.0-1055.58
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < c7498f9bc390479ccfad7c7f2332237ff4945b03 | ≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < 611ef4bd9c73d9e6d87bed57a635ff1fdd8c91ea | ≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < 6e983789b7588ee59cbf303583546c043bad8e19 | ≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < 1cc98b8887cabb1808d2f4a37cd10a7be7574771 | ≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < b7db31a52c3862a1a32202a273a4c32e7f5f4823 | ≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < 9b75dff8446ec871030d8daf5a69e74f5fe8b956 | ≥ 23461551c00628c3f3fe9cf837bf53cf8f212b63, < 7a9bc9e3f42391e4c187e099263cf7a1c4b69ff5 | 3.18
  • linux_kernel≥ 3.18, < 5.10.249 | ≥ 5.11, < 5.15.199 | ≥ 5.16, < 6.1.162 | ≥ 6.2, < 6.6.122 | ≥ 6.7, < 6.12.68 | ≥ 6.13, < 6.18.8 | 6.19:rc1 | 6.19:rc2 | 6.19:rc3 | 6.19:rc4 | 6.19:rc5 | 6.19:rc6
Debian1 product
  • linux< 6.1.162-1 | < 6.12.69-1 | < 6.18.8-1

3 vendors · 159 products

References

42 links
Show all 42 references