CVE-2026-23095

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gue: Fix skb memleak with inner IP protocol 0.

syzbot reported skb memleak below. [0]

The repro generated a GUE packet with its inner protocol 0.

gue_udp_recv() returns -guehdr->proto_ctype for "resubmit"

in ip_protocol_deliver_rcu(), but this only works with

non-zero protocol number.

Let's drop such packets.

Note that 0 is a valid number (IPv6 Hop-by-Hop Option).

I think it is not practical to encap HOPOPT in GUE, so once

someone starts to complain, we could pass down a resubmit

flag pointer to distinguish two zeros from the upper layer:

* no error

* resubmit HOPOPT

[0]

BUG: memory leak

unreferenced object 0xffff888109695a00 (size 240):

comm "syz.0.17", pid 6088, jiffies 4294943096

hex dump (first 32 bytes):

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 40 c2 10 81 88 ff ff 00 00 00 00 00 00 00 00 .@..............

backtrace (crc a84b336f):

kmemleak_alloc_recursive

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References