# CVE-2026-23016: linux: In the Linux kernel, the following vulnerability has been resolved:  inet: frags: drop fraglist conntrack references...

CVE-2026-23016 is fixed in linux on 1 platform by DEBIAN-CVE-2026-23016 (version 6.18.8-1), released January 31, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-23016
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: 0.0015
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 31, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  inet: frags: drop fraglist conntrack references  Jakub added a warning in nf_conntrack_cleanup_net_list() to make debugging leaked skbs/conntrack references more obvious.  syzbot reports this as triggering, and I can also reproduce this via ip_defrag.sh selftest:   conntrack cleanup blocked for 60s  WARNING: net/netfilter/nf_conntrack_core.c:2512  [..]  conntrack clenups gets stuck because there are skbs with still hold nf_conn references via their frag_list.     net.core.skb_defer_max=0 makes the hang disappear.  Eric Dumazet points out that skb_release_head_state() doesn't follow the fraglist.  ip_defrag.sh can only reproduce this problem since commit 6471658dc66c ("udp: use skb_attempt_defer_free()"), but AFAICS this problem could happen with TCP as well if pmtu discovery is off.  The relevant problem path for udp is: 1. netns emits fragmented packets 2. nf_defrag_v6_hook reassembles them (in output hook) 3. reassembled skb is tracked (skb owns nf_conn reference) 4. ip6_output refragments 5. refragmented packets also own nf_conn reference (ip6_fragment    calls ip6_copy_metadata()) 6. on input path, nf_defrag_v6_hook skips defragmentation: the    fragments already have skb->nf_conn attached 7. skbs are reassembled via ipv6_frag_rcv() 8. skb_consume_udp -> skb_attempt_defer_free() -> skb ends up    in pcpu freelist, but still has nf_conn reference.  Possible solutions:  1 let defrag engine drop nf_conn entry, OR  2 export kick_defer_list_purge() and call it from the conntrack    netns exit callback, OR  3 add skb_has_frag_list() check to skb_attempt_defer_free()  2 & 3 also solve ip_defrag.sh hang but share same drawback:  Such reassembled skbs, queued to socket, can prevent conntrack module removal until userspace has consumed the packet. While both tcp and udp stack do call nf_reset_ct() before placing skb on socket queue, that function doesn't iterate frag_list skbs.  Therefore drop nf_conn entries when they are placed in defrag queue. Keep the nf_conn entry of the first (offset 0) skb so that reassembled skb retains nf_conn entry for sake of TX path.  Note that fixes tag is incorrect; it points to the commit introducing the 'ip_defrag.sh reproducible problem': no need to backport this patch to every stable kernel.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 6.18.8-1 | [DEBIAN-CVE-2026-23016](https://patchblox.com/security/data/fix/linux/debian-cve-2026-23016.md) | Jan 31, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.