Technical impact
The flaw arises from a mismatch in the handling of socket buffers during UDP packet reception. The path does not invoke the skb->destructor field, while the skmsg layer does, leading to a defensive warning in skb_attempt_defer_free(). This discrepancy can result in a double free or use‑after‑free condition, classified as CWE‑416, and may corrupt kernel memory. If exploited, an attacker could potentially gain elevated privileges or crash the operating system.
Affected Systems
The vulnerability is present in the Linux kernel itself. Vendors and product families include Linux: Linux kernel, covering all compiled kernel images built from the mainline source. No explicit build or version range is specified, so any kernel that has not applied the upstream patch may be susceptible until updated.
Risk and Exploitability
The CVSS score of 7.0 indicates a high severity vulnerability, yet the EPSS score of less than 1% suggests that exploitation in the wild is currently very unlikely. The flaw is not listed in the CISA KEV catalog, further supporting the low deployment risk. The most probable attack vector is remote, using crafted UDP packets that reach processes handling network traffic. Exploitation would likely require precise timing and could demand that the attacker has network connectivity to the target system or access to services that observe UDP traffic. Even so, a successful exploit would result in kernel memory corruption, potentially allowing privilege escalation or denial of service.
