CVE-2026-23048
published 2026-02-04CVE-2026-23048: In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path does not…
PriorityP421critical9.1
EPSS
0.14%
4.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path does not use skb->destructor.
But skmsg layer does use it, since it calls skb_set_owner_sk_safe()
from udp_read_skb().
This then triggers this warning in skb_attempt_defer_free():
DEBUG_NET_WARN_ON_ONCE(skb->destructor);
We must call skb_orphan() to fix this issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.8-1 (forky) | linux 6.18.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 6471658dc66c670580a7616e75f51b52917e7883 < 0c63d5683eae6a7b4d81382bcbecb2a19feff90d | 0c63d5683eae6a7b4d81382bcbecb2a19feff90d |
| linux | linux | >= 6471658dc66c670580a7616e75f51b52917e7883 < e5c8eda39a9fc1547d1398d707aa06c1d080abdd | e5c8eda39a9fc1547d1398d707aa06c1d080abdd |
| linux | linux_kernel | >= 0 < 6.18.8-1 | 6.18.8-1 |
| linux | linux_kernel | >= 6.18.0 < 6.18.6 | 6.18.6 |
CVSS provenance
vendor_oracle9.1CRITICAL
vendor_redhat5.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h5xw-xh97-3j7m: In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path
ghsa_unreviewed·2026-02-04
CVE-2026-23048 GHSA-h5xw-xh97-3j7m: In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path
In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path does not use skb->destructor.
But skmsg layer does use it, since it calls skb_set_owner_sk_safe()
from udp_read_skb().
This then triggers this warning in skb_attempt_defer_free():
DEBUG_NET_WARN_ON_ONCE(skb->destructor);
We must call skb_orphan() to fix this issue.
OSV
CVE-2026-23048: In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path d
osv·2026-02-04
CVE-2026-23048 CVE-2026-23048: In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path d
In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path does not use skb->destructor. But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb(). This then triggers this warning in skb_attempt_defer_free(): DEBUG_NET_WARN_ON_ONCE(skb->destructor); We must call skb_orphan() to fix this issue.
OSV
udp: call skb_orphan() before skb_attempt_defer_free()
osv·2026-02-04
CVE-2026-23048 udp: call skb_orphan() before skb_attempt_defer_free()
udp: call skb_orphan() before skb_attempt_defer_free()
In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path does not use skb->destructor.
But skmsg layer does use it, since it calls skb_set_owner_sk_safe()
from udp_read_skb().
This then triggers this warning in skb_attempt_defer_free():
DEBUG_NET_WARN_ON_ONCE(skb->destructor);
We must call skb_orphan() to fix this issue.
Red Hat
kernel: udp: call skb_orphan() before skb_attempt_defer_free()
vendor_redhat·2026-02-04·CVSS 5.3
CVE-2026-23048 [LOW] CWE-476 kernel: udp: call skb_orphan() before skb_attempt_defer_free()
kernel: udp: call skb_orphan() before skb_attempt_defer_free()
In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path does not use skb->destructor.
But skmsg layer does use it, since it calls skb_set_owner_sk_safe()
from udp_read_skb().
This then triggers this warning in skb_attempt_defer_free():
DEBUG_NET_WARN_ON_ONCE(skb->destructor);
We must call skb_orphan() to fix this issue.
Statement: A WARN can be triggered in the UDP receive cleanup path because skb_attempt_defer_free expects skb destructor to be NULL. The skmsg layer can set skb destructor via skb_set_owner_sk_safe when udp_read_skb is used which makes skb_attempt_defer_free hit DEBUG_NET_WARN_ON_ONCE and generate a warning splat. For
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) — CVE-2025-23048
vendor_oracle·2026-01-15·CVSS 9.1
CVE-2025-23048 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) — CVE-2025-23048
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) vulnerability
CVE: CVE-2025-23048
CVSS: 9.1
Protocol: TLS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Debian
CVE-2026-23048: linux - In the Linux kernel, the following vulnerability has been resolved: udp: call s...
vendor_debian·2026
CVE-2026-23048 [LOW] CVE-2026-23048: linux - In the Linux kernel, the following vulnerability has been resolved: udp: call s...
In the Linux kernel, the following vulnerability has been resolved: udp: call skb_orphan() before skb_attempt_defer_free() Standard UDP receive path does not use skb->destructor. But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb(). This then triggers this warning in skb_attempt_defer_free(): DEBUG_NET_WARN_ON_ONCE(skb->destructor); We must call skb_orphan() to fix this issue.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.18.8-1)
sid: resolved (fixed in 6.18.8-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
2026-02-04
Published