CyberSecBulletin
CVE-2026-23274NVD status: Modified

Linux: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Published Updated By the CyberSecBulletin desk

CVE-2026-23274 is a high-severity reliance on undefined, unspecified, or implementation-defined behavior vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44, 144f88054ba0180467356f40895bd660b5dceeec, 28c7cfaf0c0ab17cbd7754092116fd1af45271f9 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44 or 144f88054ba0180467356f40895bd660b5dceeec or 28c7cfaf0c0ab17cbd7754092116fd1af45271f9 or 54080355999381fed4a26129579a5765bab87491, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.167 or 6.6.130, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, 32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, 144f88054ba0180467356f40895bd660b5dceeec; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, 28c7cfaf0c0ab17cbd7754092116fd1af45271f9; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, 54080355999381fed4a26129579a5765bab87491; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, 5e7ece24c5cb75a60402aad4d803c7898ea40aa9; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, f5ef97c13165542480a6ffdbe6f09f40bbb7cbf1; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, f228b9ae2a7e84d1153616d8e71c4236cb1f1309; 68983a354a655c35d3fb204489d383a2a051fda7 up to, but not including, 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf; and 1 more ranges32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44, 144f88054ba0180467356f40895bd660b5dceeec, 28c7cfaf0c0ab17cbd7754092116fd1af45271f9, 54080355999381fed4a26129579a5765bab87491, 5e7ece24c5cb75a60402aad4d803c7898ea40aa9, f5ef97c13165542480a6ffdbe6f09f40bbb7cbf1
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)V3.1.6 and later; V3.1.5 and later; V3.1.7 and laterNot stated
LinuxLinux Kernel5.7 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.167; 6.2 up to, but not including, 6.6.130; 6.7 up to, but not including, 6.12.78; 6.13 up to, but not including, 6.18.19; 6.19 up to, but not including, 6.19.9; 7.05.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer. If the label was created first by revision 1 with XT_IDLETIMER_ALARM, the object uses alarm timer semantics and timer->timer is never initialized. Reusing that object from revision 0 causes mod_timer() on an uninitialized timer_list, triggering debugobjects warnings and possible panic when panic_on_warn=1. Fix this by rejecting revision 0 rule insertion when an existing timer with the same label is of ALARM type.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

More Reliance on Undefined, Unspecified, or Implementation-Defined Behavior vulnerabilities (CWE-758)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Reliance on Undefined, Unspecified, or Implementation-Defined Behavior vulnerabilities

Spotted an error? Tell us.