CVE-2026-23143

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Feb 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel networking bug in virtual machines can send the wrong data to the network device, leading to slowdowns or crashes.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Low
Impact: Denial Of Service
Component: OS kernel
Class: Memory Corruption
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

One-byte misalignment in struct virtnet_info causes the RSS hash key passed to the virtio device to be shifted, truncating the final byte and prepending an uninitialized byte.

Why it matters to the business

Virtualized Linux systems using virtio networking may experience degraded RSS performance, traffic misdistribution, or kernel-level instability that interrupts workloads.

How an attack unfolds

A local attacker loads or reconfigures the virtio_net driver to exercise RSS setup paths; the misaligned rss_hash_key_data is copied into the device command, resulting in corrupted RSS configuration that can trigger availability impact.

How to fix it

Upgrade linux-aws-5.4 to version 5.4.0-1113.123~18.04.1 or later on Ubuntu 18.04 LTS.

How to confirm the fix worked

Confirm kernel package version matches or exceeds the fixed release; optionally rebuild with the corrected TRAILING_OVERLAP union and verify struct virtnet_info layout shows rss_hash_key_data at the expected aligned offset.

Typical attack path

Obtain local user access on an affected Linux kernel
Trigger virtio_net RSS configuration via ethtool or driver initialization
Cause the misaligned structure to be used when writing rss_trailer and hash key to the device
Observe or amplify resulting network or kernel instability

How to detect it

Review kernel logs for virtio_net RSS configuration warnings or related structure alignment messages; examine network driver initialization traces for unexpected RSS hash key behavior.

What your security team should do

Apply the fixed kernel package immediately on all exposed virtio-based instances
Prioritize systems running virtio networking with RSS enabled
Monitor for post-update stability in network performance metrics

The record

In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix misalignment bug in struct virtnet_info Use the new TRAILING_OVERLAP() helper to fix a misalignment bug along with the following warning: drivers/net/virtio_net.c:429:46: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] This helper creates a union between a flexible-array member (FAM) and a set of members that would otherwise follow it (in this case `u8 rss_hash_key_data[VIRTIO_NET_RSS_MAX_KEY_SIZE];`). This overlays the trailing members (rss_hash_key_data) onto the FAM (hash_key_data) while keeping the FAM and the start of MEMBERS aligned. The static_assert() ensures this alignment remains. Notice that due to tail padding in flexible `struct virtio_net_rss_config_trailer`, `rss_trailer.hash_key_data` (at offset 83 in struct virtnet_info) and `rss_hash_key_data` (at offset 84 in struct virtnet_info) are misaligned by one byte. See below: struct virtio_net_rss_config_trailer { __le16 max_tx_vq; /* 0 2 */ __u8 hash_key_length; /* 2 1 */ __u8 hash_key_data[]; /* 3 0 */ /* size: 4, cachelines: 1, members: 3 */ /* padding: 1 */ /* last cacheline: 4 bytes */ }; struct virtnet_info { ... struct virtio_net_rss_config_trailer rss_trailer; /* 80 4 */ /* XXX last struct has 1 byte of padding */ u8 rss_hash_key_data[40]; /* 84 40 */ ... /* size: 832, cachelines: 13, members: 48 */ /* sum members: 801, holes: 8, sum holes: 31 */ /* paddings: 2, sum paddings: 5 */ }; After changes, those members are correctly aligned at offset 795: struct virtnet_info { ... union { struct virtio_net_rss_config_trailer rss_trailer; /* 792 4 */ struct { unsigned char __offset_to_hash_key_data[3]; /* 792 3 */ u8 rss_hash_key_data[40]; /* 795 40 */ }; /* 792 43 */ }; /* 792 44 */ ... /* size: 840, cachelines: 14, members: 47 */ /* sum members: 801, holes: 8, sum holes: 35 */ /* padding: 4 */ /* paddings: 1, sum paddings: 4 */ /* last cacheline: 8 bytes */ }; As a result, the RSS key passed to the device is shifted by 1 byte: the last byte is cut off, and instead a (possibly uninitialized) byte is added at the beginning. As a last note `struct virtio_net_rss_config_hdr *rss_hdr;` is also moved to the end, since it seems those three members should stick around together. :)

Affected packages

Ecosystem	Package	Introduced	Fixed
Linux	Kernel	6.15.0	6.18.7