Loading vulnerability…
CVE-2026-23204 affects the Linux kernel's cls_u32 traffic-control classifier. The skb_header_pointer() helper incompletely validates negative offset values, allowing u32_classify() to access memory outside a slab allocation. A reproducer demonstrated the issue through a KASAN slab-out-of-bounds error. The fix replaces skb_header_pointer() with skb_header_pointer_careful() in the affected classifier.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel vulnerability in the cls_u32 network traffic classifier results from insufficient validation of negative offsets by skb_header_pointer(). A reported reproducer triggers a slab-out-of-bounds error. The listed CVSS v3 score is 7.1, with local access and low privileges required, potentially affecting confidentiality and availability. The fix replaces the function with skb_header_pointer_careful().
A Linux kernel vulnerability in the cls_u32 network classifier caused by insufficient validation of negative offsets in skb_header_pointer(), resulting in slab out-of-bounds access. The reference assigns a CVSS v3 score of 7.1, with local attack access, low privileges required, and high confidentiality and availability impact. The fix uses skb_header_pointer_careful(); affected Google kernel packages should be updated to version 19506.0.32 or later.
Vulnerability referenced by the advisory; no individual description is provided.
Linux kernel networking vulnerability remediated by adding the skb_header_pointer_careful() helper. This CVE is the source for the plugin's CVSS v3 score.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.