VulnerabilityPublished 18 Mar 2026Updated 5 Nov 2026

CVE-2026-23262: Linux kernel · gve: Fix stats report corruption on queue count change

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f432f7613c220db32c2c6942420daf7b3f2e7d7e : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:49 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f432f7613c220db32c2c6942420daf7b3f2e7d7e, df54838ab61826ecc1a562ffa5e280c3ab7289a7, 837c662f47dac43efa1aef2dd433c6b4b4c073af +4

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 24aeb56f2d38edf1b324bdb4f8bc6faf9f0f540c, < f432f7613c220db32c2c6942420daf7b3f2e7d7e	Fixed in f432f7613c220db32c2c6942420daf7b3f2e7d7e
LinuxLinux	Affected ≥ 24aeb56f2d38edf1b324bdb4f8bc6faf9f0f540c, < df54838ab61826ecc1a562ffa5e280c3ab7289a7	Fixed in df54838ab61826ecc1a562ffa5e280c3ab7289a7
LinuxLinux	Affected ≥ 24aeb56f2d38edf1b324bdb4f8bc6faf9f0f540c, < 837c662f47dac43efa1aef2dd433c6b4b4c073af	Fixed in 837c662f47dac43efa1aef2dd433c6b4b4c073af
LinuxLinux	Affected ≥ 24aeb56f2d38edf1b324bdb4f8bc6faf9f0f540c, < 11f8311f69e4c361717371b4901ff92daeb76e9c	Fixed in 11f8311f69e4c361717371b4901ff92daeb76e9c
LinuxLinux	Affected ≥ 24aeb56f2d38edf1b324bdb4f8bc6faf9f0f540c, < 9fa0a755db3e1945fe00f73fe27d85ef6c8818b7	Fixed in 9fa0a755db3e1945fe00f73fe27d85ef6c8818b7
LinuxLinux	Affected ≥ 24aeb56f2d38edf1b324bdb4f8bc6faf9f0f540c, < 9d93332397405b62a3300b22d04ac65d990b91ff	Fixed in 9d93332397405b62a3300b22d04ac65d990b91ff

Description

In the Linux kernel, the following vulnerability has been resolved: gve: Fix stats report corruption on queue count change The driver and the NIC share a region in memory for stats reporting. The NIC calculates its offset into this region based on the total size of the stats region and the size of the NIC's stats. When the number of queues is changed, the driver's stats region is resized. If the queue count is increased, the NIC can write past the end of the allocated stats region, causing memory corruption. If the queue count is decreased, there is a gap between the driver and NIC stats, leading to incorrect stats reporting. This change fixes the issue by allocating stats region with maximum size, and the offset calculation for NIC stats is changed to match with the calculation of the NIC.

References

Community reviews

Loading reviews…