CVE-2026-23331 udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
A logic error in Linux kernel UDP handling leaves stale entries in hash tables upon disconnection, potentially causing resource exhaustion or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23331?
CVE-2026-23331 is a medium-severity vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and disconnect it from the address.
bind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not SOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put the socket into the 4-tuple hash table.
Then, __udp_disconnect() calls sk->sk_prot->rehash(sk).
It computes a new hash based on the wildcard address and moves the socket to a new slot in the 4-tuple hash table, leaving a garbage in the chain that no packet hits.
Let's remove such a socket from 4-tuple hash table when disconnected.
Note that udp_sk(sk)->udp_portaddr_hash needs to be udpated after udp_hash4_dec(hslot2) in udp_unhash4().
Which versions are affected by CVE-2026-23331?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23331?
Apply the vendor's patch.
Is CVE-2026-23331 being exploited?
There is no known exploitation of CVE-2026-23331 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23331, DEBIAN-CVE-2026-23331, GHSA-jc3m-qg79-3244, UBUNTU-CVE-2026-23331.