{
  "cveId": "CVE-2026-23016",
  "url": "https://patchblox.com/security/cve/CVE-2026-23016",
  "summary": "CVE-2026-23016 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23016 (version 6.18.8-1), released January 31, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  inet: frags: drop fraglist conntrack references...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  inet: frags: drop fraglist conntrack references  Jakub added a warning in nf_conntrack_cleanup_net_list() to make debugging leaked skbs/conntrack references more obvious.  syzbot reports this as triggering, and I can also reproduce this via ip_defrag.sh selftest:   conntrack cleanup blocked for 60s  WARNING: net/netfilter/nf_conntrack_core.c:2512  [..]  conntrack clenups gets stuck because there are skbs with still hold nf_conn references via their frag_list.     net.core.skb_defer_max=0 makes the hang disappear.  Eric Dumazet points out that skb_release_head_state() doesn\u0027t follow the fraglist.  ip_defrag.sh can only reproduce this problem since commit 6471658dc66c (\u0022udp: use skb_attempt_defer_free()\u0022), but AFAICS this problem could happen with TCP as well if pmtu discovery is off.  The relevant problem path for udp is: 1. netns emits fragmented packets 2. nf_defrag_v6_hook reassembles them (in output hook) 3. reassembled skb is tracked (skb owns nf_conn reference) 4. ip6_output refragments 5. refragmented packets also own nf_conn reference (ip6_fragment    calls ip6_copy_metadata()) 6. on input path, nf_defrag_v6_hook skips defragmentation: the    fragments already have skb-\u003Enf_conn attached 7. skbs are reassembled via ipv6_frag_rcv() 8. skb_consume_udp -\u003E skb_attempt_defer_free() -\u003E skb ends up    in pcpu freelist, but still has nf_conn reference.  Possible solutions:  1 let defrag engine drop nf_conn entry, OR  2 export kick_defer_list_purge() and call it from the conntrack    netns exit callback, OR  3 add skb_has_frag_list() check to skb_attempt_defer_free()  2 \u0026 3 also solve ip_defrag.sh hang but share same drawback:  Such reassembled skbs, queued to socket, can prevent conntrack module removal until userspace has consumed the packet. While both tcp and udp stack do call nf_reset_ct() before placing skb on socket queue, that function doesn\u0027t iterate frag_list skbs.  Therefore drop nf_conn entries when they are placed in defrag queue. Keep the nf_conn entry of the first (offset 0) skb so that reassembled skb retains nf_conn entry for sake of TX path.  Note that fixes tag is incorrect; it points to the commit introducing the \u0027ip_defrag.sh reproducible problem\u0027: no need to backport this patch to every stable kernel.",
  "published": "2026-01-31T12:16:04Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00152,
  "epssPercentile": 0.04429,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.18.8-1",
      "fix": "DEBIAN-CVE-2026-23016",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23016",
      "released": "2026-01-31T12:16:04Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}