« Volver al listado

CVE-2026-23048

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

udp: call skb_orphan() before skb_attempt_defer_free()

Standard UDP receive path does not use skb->destructor.

But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb().

This then triggers this warning in skb_attempt_defer_free():

We must call skb_orphan() to fix this issue.

Detalles técnicos trazas, registros y código del informe original
    DEBUG_NET_WARN_ON_ONCE(skb->destructor);

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-23048",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6471658dc66c670580a7616e75f51b52917e7883",
              "lessThan": "0c63d5683eae6a7b4d81382bcbecb2a19feff90d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6471658dc66c670580a7616e75f51b52917e7883",
              "lessThan": "e5c8eda39a9fc1547d1398d707aa06c1d080abdd",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/ipv4/udp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv4/udp.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-02-04T16:16:20.343",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0c63d5683eae6a7b4d81382bcbecb2a19feff90d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e5c8eda39a9fc1547d1398d707aa06c1d080abdd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: call skb_orphan() before skb_attempt_defer_free()\n\nStandard UDP receive path does not use skb->destructor.\n\nBut skmsg layer does use it, since it calls skb_set_owner_sk_safe()\nfrom udp_read_skb().\n\nThis then triggers this warning in skb_attempt_defer_free():\n\n    DEBUG_NET_WARN_ON_ONCE(skb->destructor);\n\nWe must call skb_orphan() to fix this issue."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nudp: llamar a skb_orphan() antes de skb_attempt_defer_free()\n\nLa ruta de recepción UDP estándar no utiliza skb->destructor.\n\nPero la capa skmsg sí lo utiliza, ya que llama a skb_set_owner_sk_safe() desde udp_read_skb().\n\nEsto entonces activa esta advertencia en skb_attempt_defer_free():\n\nDEBUG_NET_WARN_ON_ONCE(skb->destructor);\n\nDebemos llamar a skb_orphan() para solucionar este problema."
    }
  ],
  "lastModified": "2026-06-17T10:20:46.290",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}