In the Linux kernel, an improper handling of the skb->dev field in the UDP receive path can cause a general protection fault. The field, repurposed as dev_scratch during an in‑flight UDP packet, remains non‑NULL when a sockmap verdict program performs a socket lookup. The lookup function interprets this value as a net_device pointer, dereferencing an invalid memory address and crashing the kernel with an oops. The crash degrades system availability and requires a reboot, providing an attack surface for denial of service.

The issue affects all Linux kernel implementations that incorporate the buggy udp code before the patch that clears skb->dev before running a sockmap verdict. The commit references in the advisory (e.g., 1b585673a2249f13678e7ac443ac683ba767e0b6) represent the fixes applied. No specific version numbers are listed, so any supported kernel that has not yet applied this change is vulnerable.

The vulnerability is exploitable by an attacker who can craft a UDP packet that triggers a sockmap verdict program using socket‑lookup helpers, or by injecting a malicious BPF program that exercises the same code path. The lack of an EPSS score and absence from the KEV catalog suggest no publicly documented exploits, but the code path is reachable through normal networking operations and BPF interfaces. Because the fault occurs in softirq, it is straightforward to trigger a panic once the conditions are satisfied, and the crash provides a deterministic denial of service vector.