CVE-2026-43164

A flaw was found in the Linux kernel's UDP-Lite (User Datagram Protocol-Lite) implementation. An issue during the initialization of UDP-Lite sockets can lead to a null-pointer dereference in the __udp_enqueue_schedule_skb() function. This vulnerability could allow an attacker to trigger a system crash, resulting in a Denial of Service (DoS).

A moderate severity flaw was found in the Linux kernel's UDP-Lite (UDPLite) implementation. When a UDP-Lite socket is created, initialization performed by udp_lib_init_sock(), udp_init_sock(), or udpv6_init_sock() can fail; the UDP-Lite initialization paths udplite_sk_init() and udplitev6_sk_init() did not handle this failure, leaving per-socket queue state (udp_sk(sk)->udp_prod_queue) uninitialized. Subsequent packet processing can then dereference this NULL pointer in __udp_enqueue_schedule_skb(), crashing the kernel and causing a denial of service. Red Hat rates this flaw MODERATE (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5) because triggering it requires a local user or process to first create and use a partially initialized UDP-Lite socket on the target system, with reliable triggering depending on making socket initialization fail, for example through resource pressure. This differs from the upstream CVEORG severity of 7.5 (AV:N), which assumes a remotely exploitable attack path that Red Hat's analysis does not support. The vulnerable code is not present in the shipped Red Hat Enterprise Linux 7, 8, 9, and 10 kernel and kernel-rt packages or in Red Hat In-Vehicle OS 2.0, so those products are not affected; the only other in-scope entry, Red Hat Enterprise Linux 6 Extended Lifecycle Support, is out of support scope. Upstream fixed this by handling the initialization error in udplite_sk_init() and udplitev6_sk_init().

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.