CVE-2026-53184 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

udp: clear skb->dev before running a sockmap verdict

On the UDP receive path skb->dev is repurposed as dev_scratch (the
truesize/state cache set by udp_set_dev_scratch()), through the
union { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.

When a UDP socket is in a sockmap, sk_data_ready is
sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor()
(sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq.
If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp,
bpf_skc_lookup_tcp), bpf_skc_lookup() does:

if (skb->dev)
caller_net = dev_net(skb->dev);

skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net()
dereferences it as a struct net_device * and the kernel takes a general
protection fault on a non-canonical address in softirq:

Oops: general protection fault, probably for non-canonical address 0x1010000800004a0
CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full)
RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline]
RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047
Call Trace:
<IRQ>
bpf_prog_4675cb904b7071f8+0x12e/0x14e
bpf_prog_run_pin_on_cpu+0xc6/0x1f0
sk_psock_verdict_recv+0x1ba/0x350
udp_read_skb+0x31a/0x370
sk_psock_verdict_data_ready+0x2e3/0x600
__udp_enqueue_schedule_skb+0x4c8/0x650
udpv6_queue_rcv_one_skb+0x3ec/0x740
udp6_unicast_rcv_skb+0x11d/0x140
ip6_protocol_deliver_rcu+0x61e/0x950
ip6_input_finish+0xa9/0x150
NF_HOOK+0x286/0x2f0
ip6_input+0x117/0x220
NF_HOOK+0x286/0x2f0
__netif_receive_skb+0x85/0x200
process_backlog+0x374/0x9a0
__napi_poll+0x4f/0x1c0
net_rx_action+0x3b0/0x770
handle_softirqs+0x15a/0x460
do_softirq+0x57/0x80
</IRQ>

The rmem charge that dev_scratch accounted for is released by skb_recv_udp() on
dequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear
skb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which
skb_set_owner_sk_safe() set just above.

Published: 2026-06-25

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, an improper handling of the skb->dev field in the UDP receive path can cause a general protection fault. The field, repurposed as dev_scratch during an in‑flight UDP packet, remains non‑NULL when a sockmap verdict program performs a socket lookup. The lookup function interprets this value as a net_device pointer, dereferencing an invalid memory address and crashing the kernel with an oops. The crash degrades system availability.

Affected Systems

The issue affects all Linux kernel implementations that incorporate the buggy udp code before the patch that map verdict. The commit references in the advisory (e.g., 1b585673a2249ac683ba767e0b6) represent the listed, so any supported kernel that has not yet applied this change is vulnerable.

Risk and Exploitability

The vulnerability is exploitable by an attacker who can craft a UDP packet that triggers a sockmap verdict program using socket‑lookup helpers. The EPSS score is the vulnerability is not listed in the KEV catalog, suggesting no publicly documented exploits. The code path is reachable through normal networking operations and BPF interfaces, and because the fault occurs in softirq it is straightforward to trigger a panic once the conditions are satisfied, providing a deterministic denial of service vector. The CVSS score of 7.5 indicates high severity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`965b57b469a589d64d81b1688b38dcb537011bb0`	affected	< 263779a6beff03b8b06f6d25566cb0f45af361f2
`965b57b469a589d64d81b1688b38dcb537011bb0`	affected	< 1b585673a2249f13678e7ac443ac683ba767e0b6
`965b57b469a589d64d81b1688b38dcb537011bb0`	affected	< 90d35188aaa92b8f8b23f66335e0e91bf60103a3
`965b57b469a589d64d81b1688b38dcb537011bb0`	affected	< 6822eed69572000a181fa4e31fceacc60918c471
`965b57b469a589d64d81b1688b38dcb537011bb0`	affected	< 7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1
`965b57b469a589d64d81b1688b38dcb537011bb0`	affected	< 3c94f241f776562c489876ff506f366224565c21

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[965b57b469a589d64d81b1688b38dcb537011bb0,263779a6beff03b8b06f6d25566cb0f45af361f2)`	affected	code_commit	—
`[965b57b469a589d64d81b1688b38dcb537011bb0,1b585673a2249f13678e7ac443ac683ba767e0b6)`	affected	code_commit	—
`[965b57b469a589d64d81b1688b38dcb537011bb0,90d35188aaa92b8f8b23f66335e0e91bf60103a3)`	affected	code_commit	—
`[965b57b469a589d64d81b1688b38dcb537011bb0,6822eed69572000a181fa4e31fceacc60918c471)`	affected	code_commit	—
`[965b57b469a589d64d81b1688b38dcb537011bb0,7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1)`	affected	code_commit	—
`[965b57b469a589d64d81b1688b38dcb537011bb0,3c94f241f776562c489876ff506f366224565c21)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	generic	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the patch clearing skb->dev before running a sockmap verdict (commit 1b585673a2249f13678e7ac443ac683ba767e0b6 and associated updates).
If an immediate kernel upgrade is not possible, disable or remove any BPF sockmap verdict programs that invoke socket‑lookup helpers (bpf_sk_lookup_tcp/udp), as the failure occurs only when those helpers are used.
Continuously monitor kernel logs (dmesg, /var/log/kern.log) for general protection fault or oops messages that indicate the crash has occurred, and trigger alerts if such events are detected.

Generated by OpenCVE AI on June 28, 2026 at 14:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00506.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1b585673a2249f13678e7ac443ac683ba767e0b6
https://git.kernel.org/stable/c/263779a6beff03b8b06f6d25566cb0f45af361f2
https://git.kernel.org/stable/c/3c94f241f776562c489876ff506f366224565c21
https://git.kernel.org/stable/c/6822eed69572000a181fa4e31fceacc60918c471
https://git.kernel.org/stable/c/7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1
https://git.kernel.org/stable/c/90d35188aaa92b8f8b23f66335e0e91bf60103a3
https://lore.kernel.org/linux-cve-announce/2026062556-CVE-2026-53184-a7a3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53184
https://www.cve.org/CVERecord?id=CVE-2026-53184

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Fri, 26 Jun 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-909
References		https://lore.kernel.org/linux-cve-announce/2026062556-CVE-2026-53184-a7a3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53184 https://www.cve.org/CVERecord?id=CVE-2026-53184
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 25 Jun 2026 11:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 25 Jun 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: udp: clear skb->dev before running a sockmap verdict On the UDP receive path skb->dev is repurposed as dev_scratch (the truesize/state cache set by udp_set_dev_scratch()), through the union { struct net_device dev; unsigned long dev_scratch; } in sk_buff. When a UDP socket is in a sockmap, sk_data_ready is sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor() (sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq. If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp), bpf_skc_lookup() does: if (skb->dev) caller_net = dev_net(skb->dev); skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net() dereferences it as a struct net_device and the kernel takes a general protection fault on a non-canonical address in softirq: Oops: general protection fault, probably for non-canonical address 0x1010000800004a0 CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full) RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline] RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047 Call Trace: <IRQ> bpf_prog_4675cb904b7071f8+0x12e/0x14e bpf_prog_run_pin_on_cpu+0xc6/0x1f0 sk_psock_verdict_recv+0x1ba/0x350 udp_read_skb+0x31a/0x370 sk_psock_verdict_data_ready+0x2e3/0x600 __udp_enqueue_schedule_skb+0x4c8/0x650 udpv6_queue_rcv_one_skb+0x3ec/0x740 udp6_unicast_rcv_skb+0x11d/0x140 ip6_protocol_deliver_rcu+0x61e/0x950 ip6_input_finish+0xa9/0x150 NF_HOOK+0x286/0x2f0 ip6_input+0x117/0x220 NF_HOOK+0x286/0x2f0 __netif_receive_skb+0x85/0x200 process_backlog+0x374/0x9a0 __napi_poll+0x4f/0x1c0 net_rx_action+0x3b0/0x770 handle_softirqs+0x15a/0x460 do_softirq+0x57/0x80 </IRQ> The rmem charge that dev_scratch accounted for is released by skb_recv_udp() on dequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear skb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which skb_set_owner_sk_safe() set just above.
Title		udp: clear skb->dev before running a sockmap verdict
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1b585673a2249f13678e7ac443ac683ba767e0b6 https://git.kernel.org/stable/c/263779a6beff03b8b06f6d25566cb0f45af361f2 https://git.kernel.org/stable/c/3c94f241f776562c489876ff506f366224565c21 https://git.kernel.org/stable/c/6822eed69572000a181fa4e31fceacc60918c471 https://git.kernel.org/stable/c/7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1 https://git.kernel.org/stable/c/90d35188aaa92b8f8b23f66335e0e91bf60103a3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-25T08:38:58.189Z

Updated: 2026-06-28T06:39:58.363Z

Reserved: 2026-06-09T07:44:35.390Z

Link: CVE-2026-53184

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-06-25T00:00:00Z

Links: CVE-2026-53184 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T14:30:07Z

Weaknesses

CWE-909
Missing Initialization of Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object