{"id":"CVE-2026-23016","summary":"inet: frags: drop fraglist conntrack references","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: drop fraglist conntrack references\n\nJakub added a warning in nf_conntrack_cleanup_net_list() to make debugging\nleaked skbs/conntrack references more obvious.\n\nsyzbot reports this as triggering, and I can also reproduce this via\nip_defrag.sh selftest:\n\n conntrack cleanup blocked for 60s\n WARNING: net/netfilter/nf_conntrack_core.c:2512\n [..]\n\nconntrack clenups gets stuck because there are skbs with still hold nf_conn\nreferences via their frag_list.\n\n   net.core.skb_defer_max=0 makes the hang disappear.\n\nEric Dumazet points out that skb_release_head_state() doesn't follow the\nfraglist.\n\nip_defrag.sh can only reproduce this problem since\ncommit 6471658dc66c (\"udp: use skb_attempt_defer_free()\"), but AFAICS this\nproblem could happen with TCP as well if pmtu discovery is off.\n\nThe relevant problem path for udp is:\n1. netns emits fragmented packets\n2. nf_defrag_v6_hook reassembles them (in output hook)\n3. reassembled skb is tracked (skb owns nf_conn reference)\n4. ip6_output refragments\n5. refragmented packets also own nf_conn reference (ip6_fragment\n   calls ip6_copy_metadata())\n6. on input path, nf_defrag_v6_hook skips defragmentation: the\n   fragments already have skb-\u003enf_conn attached\n7. skbs are reassembled via ipv6_frag_rcv()\n8. skb_consume_udp -\u003e skb_attempt_defer_free() -\u003e skb ends up\n   in pcpu freelist, but still has nf_conn reference.\n\nPossible solutions:\n 1 let defrag engine drop nf_conn entry, OR\n 2 export kick_defer_list_purge() and call it from the conntrack\n   netns exit callback, OR\n 3 add skb_has_frag_list() check to skb_attempt_defer_free()\n\n2 & 3 also solve ip_defrag.sh hang but share same drawback:\n\nSuch reassembled skbs, queued to socket, can prevent conntrack module\nremoval until userspace has consumed the packet. While both tcp and udp\nstack do call nf_reset_ct() before placing skb on socket queue, that\nfunction doesn't iterate frag_list skbs.\n\nTherefore drop nf_conn entries when they are placed in defrag queue.\nKeep the nf_conn entry of the first (offset 0) skb so that reassembled\nskb retains nf_conn entry for sake of TX path.\n\nNote that fixes tag is incorrect; it points to the commit introducing the\n'ip_defrag.sh reproducible problem': no need to backport this patch to\nevery stable kernel.","modified":"2026-08-12T03:51:46.087412158Z","published":"2026-01-31T11:38:59.578Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23016.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/088ca99dbb039c444c3ff987c5412a73f4f0cbf8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2ef02ac38d3c17f34a00c4b267d961a8d4b45d1a"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23016.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23016"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6471658dc66c670580a7616e75f51b52917e7883"},{"fixed":"088ca99dbb039c444c3ff987c5412a73f4f0cbf8"},{"fixed":"2ef02ac38d3c17f34a00c4b267d961a8d4b45d1a"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23016.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.18.0"},{"fixed":"6.18.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23016.json"}}],"schema_version":"1.9.0"}