CVE-2026-23048

udp: call skb_orphan() before skb_attempt_defer_free()

published February 4, 2026

CVSS
—
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

udp: call skb_orphan() before skb_attempt_defer_free()

Standard UDP receive path does not use skb->destructor.

But skmsg layer does use it, since it calls skb_set_owner_sk_safe()

from udp_read_skb().

This then triggers this warning in skb_attempt_defer_free():

DEBUG_NET_WARN_ON_ONCE(skb->destructor);

We must call skb_orphan() to fix this issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Published
2026-02-04T16:00Z
EPSS history
Timeline
  • 04 FEB 16:00Z
    udp: call skb_orphan() before skb_attempt_defer_free()
    cvelistv5