CVE-2026-23048: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23048 is a Linux kernel vulnerability in the UDP networking subsystem where skb_orphan() is not called before skb_attempt_defer_free(), triggering a kernel warning when the skmsg layer sets a socket buffer destructor via skb_set_owner_sk_safe() from udp_read_skb(). The standard UDP receive path does not use skb->destructor, but the skmsg layer does, causing a DEBUG_NET_WARN_ON_ONCE(skb->destructor) assertion to fire. The vulnerability was published on February 4, 2026, and affects Linux kernel versions in the range introduced by commit 6471658dc66c up to the fixes applied in kernel 6.18.6 and 6.19-rc5. The CVSS base score has not been formally assigned (estimated Medium severity by Feedly) (Feedly, EUVD).

The root cause is a missing skb_orphan() call in the UDP receive path before invoking skb_attempt_defer_free() (CWE classification not formally assigned, but relates to improper resource management). When a socket buffer (skb) passes through the skmsg layer — specifically when udp_read_skb() calls skb_set_owner_sk_safe() — the skb's destructor field is set. Subsequently, when skb_attempt_defer_free() is called, it asserts that no destructor is present via DEBUG_NET_WARN_ON_ONCE(skb->destructor), triggering a kernel warning. The fix involves inserting a call to skb_orphan() to clear the destructor before the deferred free attempt, as implemented in kernel commits 0c63d5683eae and e5c8eda39a9f (Kernel Git, Kernel Git).

The primary impact is a kernel warning/assertion trigger in debug-enabled kernels, which can cause instability or unexpected behavior in the UDP networking stack when the skmsg layer is in use. In production kernels without debug assertions, the missing skb_orphan() call may lead to improper socket buffer lifecycle management, potentially causing memory management issues or use-after-free conditions in edge cases. The scope is limited to systems running affected Linux kernel versions that use the skmsg layer with UDP sockets (Feedly, EUVD).

The fix has been applied in Linux kernel version 6.18.6 and the 6.19-rc5 release candidate, via commits 0c63d5683eae6a7b4d81382bcbecb2a19feff90d and e5c8eda39a9fc1547d1398d707aa06c1d080abdd. Administrators should update to Linux kernel 6.18.6 or later. As a workaround, avoiding configurations that route UDP traffic through the skmsg layer (e.g., BPF socket message programs on UDP sockets) may reduce exposure until a patch can be applied (Kernel Git, Kernel Git).