CVE-2026-23048

In the Linux kernel, the following vulnerability has been resolved:

udp: call skb_orphan() before skb_attempt_defer_free()

Standard UDP receive path does not use skb->destructor.

But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb().

This then triggers this warning in skb_attempt_defer_free():

DEBUG_NET_WARN_ON_ONCE(skb->destructor);

We must call skb_orphan() to fix this issue.

A WARN can be triggered in the UDP receive cleanup path because skb_attempt_defer_free expects skb destructor to be NULL. The skmsg layer can set skb destructor via skb_set_owner_sk_safe when udp_read_skb is used which makes skb_attempt_defer_free hit DEBUG_NET_WARN_ON_ONCE and generate a warning splat. For the CVSS the PR value in the paranoid score is PR:N because a remote sender can potentially influence UDP traffic patterns and trigger the receive path without needing local privileges if the service exposes UDP sockets that use skmsg. The issue is network reachable in scenarios where the affected UDP and skmsg code path is used by an exposed service. Impact is denial of service in the form of warning storms and potential instability. In many production kernels WARN does not crash the system but it can still disrupt operations and in some configurations it can be escalated to a crash if warnings are treated as fatal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.