{"id":"CVE-2026-53184","state":"PUBLISHED","title":"udp: clear skb->dev before running a sockmap verdict","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: clear skb->dev before running a sockmap verdict\n\nOn the UDP receive path skb->dev is repurposed as dev_scratch (the\ntruesize/state cache set by udp_set_dev_scratch()), through the\nunion { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.\n\nWhen a UDP socket is in a sockmap, sk_data_ready is\nsk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor()\n(sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq.\nIf that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp,\nbpf_skc_lookup_tcp), bpf_skc_lookup() does:\n\n\tif (skb->dev)\n\t\tcaller_net = dev_net(skb->dev);\n\nskb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net()\ndereferences it as a struct net_device * and the kernel takes a general\nprotection fault on a non-canonical address in softirq:\n\n  Oops: general protection fault, probably for non-canonical address 0x1010000800004a0\n  CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full)\n  RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline]\n  RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047\n  Call Trace:\n   <IRQ>\n   bpf_prog_4675cb904b7071f8+0x12e/0x14e\n   bpf_prog_run_pin_on_cpu+0xc6/0x1f0\n   sk_psock_verdict_recv+0x1ba/0x350\n   udp_read_skb+0x31a/0x370\n   sk_psock_verdict_data_ready+0x2e3/0x600\n   __udp_enqueue_schedule_skb+0x4c8/0x650\n   udpv6_queue_rcv_one_skb+0x3ec/0x740\n   udp6_unicast_rcv_skb+0x11d/0x140\n   ip6_protocol_deliver_rcu+0x61e/0x950\n   ip6_input_finish+0xa9/0x150\n   NF_HOOK+0x286/0x2f0\n   ip6_input+0x117/0x220\n   NF_HOOK+0x286/0x2f0\n   __netif_receive_skb+0x85/0x200\n   process_backlog+0x374/0x9a0\n   __napi_poll+0x4f/0x1c0\n   net_rx_action+0x3b0/0x770\n   handle_softirqs+0x15a/0x460\n   do_softirq+0x57/0x80\n   </IRQ>\n\nThe rmem charge that dev_scratch accounted for is released by skb_recv_udp() on\ndequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear\nskb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which\nskb_set_owner_sk_safe() set just above.","publishedAt":"2026-06-25T08:38:58.189Z","updatedAt":"2026-10-19T19:57:26.714Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"263779a6beff03b8b06f6d25566cb0f45af361f2","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"1b585673a2249f13678e7ac443ac683ba767e0b6","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"90d35188aaa92b8f8b23f66335e0e91bf60103a3","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"6822eed69572000a181fa4e31fceacc60918c471","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"3c94f241f776562c489876ff506f366224565c21","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/udp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.94","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.36","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.13","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/udp.c"]}],"references":["https://git.kernel.org/stable/c/263779a6beff03b8b06f6d25566cb0f45af361f2","https://git.kernel.org/stable/c/1b585673a2249f13678e7ac443ac683ba767e0b6","https://git.kernel.org/stable/c/90d35188aaa92b8f8b23f66335e0e91bf60103a3","https://git.kernel.org/stable/c/6822eed69572000a181fa4e31fceacc60918c471","https://git.kernel.org/stable/c/7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1","https://git.kernel.org/stable/c/3c94f241f776562c489876ff506f366224565c21","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/53xxx/CVE-2026-53184.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-53184","state":"PUBLISHED","datePublished":"2026-06-25T08:38:58.189Z","dateUpdated":"2026-10-19T19:57:26.714Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-06-09T07:44:35.390Z"},"containers":{"cna":{"title":"udp: clear skb->dev before running a sockmap verdict","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: clear skb->dev before running a sockmap verdict\n\nOn the UDP receive path skb->dev is repurposed as dev_scratch (the\ntruesize/state cache set by udp_set_dev_scratch()), through the\nunion { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.\n\nWhen a UDP socket is in a sockmap, sk_data_ready is\nsk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor()\n(sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq.\nIf that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp,\nbpf_skc_lookup_tcp), bpf_skc_lookup() does:\n\n\tif (skb->dev)\n\t\tcaller_net = dev_net(skb->dev);\n\nskb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net()\ndereferences it as a struct net_device * and the kernel takes a general\nprotection fault on a non-canonical address in softirq:\n\n  Oops: general protection fault, probably for non-canonical address 0x1010000800004a0\n  CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full)\n  RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline]\n  RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047\n  Call Trace:\n   <IRQ>\n   bpf_prog_4675cb904b7071f8+0x12e/0x14e\n   bpf_prog_run_pin_on_cpu+0xc6/0x1f0\n   sk_psock_verdict_recv+0x1ba/0x350\n   udp_read_skb+0x31a/0x370\n   sk_psock_verdict_data_ready+0x2e3/0x600\n   __udp_enqueue_schedule_skb+0x4c8/0x650\n   udpv6_queue_rcv_one_skb+0x3ec/0x740\n   udp6_unicast_rcv_skb+0x11d/0x140\n   ip6_protocol_deliver_rcu+0x61e/0x950\n   ip6_input_finish+0xa9/0x150\n   NF_HOOK+0x286/0x2f0\n   ip6_input+0x117/0x220\n   NF_HOOK+0x286/0x2f0\n   __netif_receive_skb+0x85/0x200\n   process_backlog+0x374/0x9a0\n   __napi_poll+0x4f/0x1c0\n   net_rx_action+0x3b0/0x770\n   handle_softirqs+0x15a/0x460\n   do_softirq+0x57/0x80\n   </IRQ>\n\nThe rmem charge that dev_scratch accounted for is released by skb_recv_udp() on\ndequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear\nskb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which\nskb_set_owner_sk_safe() set just above."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"263779a6beff03b8b06f6d25566cb0f45af361f2","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"1b585673a2249f13678e7ac443ac683ba767e0b6","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"90d35188aaa92b8f8b23f66335e0e91bf60103a3","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"6822eed69572000a181fa4e31fceacc60918c471","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1","versionType":"git"},{"version":"965b57b469a589d64d81b1688b38dcb537011bb0","status":"affected","lessThan":"3c94f241f776562c489876ff506f366224565c21","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/udp.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.0","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.0","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.94","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.36","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.13","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/udp.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/263779a6beff03b8b06f6d25566cb0f45af361f2"},{"url":"https://git.kernel.org/stable/c/1b585673a2249f13678e7ac443ac683ba767e0b6"},{"url":"https://git.kernel.org/stable/c/90d35188aaa92b8f8b23f66335e0e91bf60103a3"},{"url":"https://git.kernel.org/stable/c/6822eed69572000a181fa4e31fceacc60918c471"},{"url":"https://git.kernel.org/stable/c/7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1"},{"url":"https://git.kernel.org/stable/c/3c94f241f776562c489876ff506f366224565c21"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached on the IPv4/IPv6 UDP receive path when a packet is delivered to a UDP socket using sockmap verdict handling. In a reasonable deployment where such a socket is exposed by a service, a remote sender can trigger the path with UDP traffic.\nAC:L - There is no race or timing requirement; once the UDP socket has a SK_SKB sockmap verdict program that calls a socket-lookup helper, a received UDP packet reliably drives the stale skb->dev dereference. The required sockmap/verdict configuration is a deployment condition, not an attacker-controlled race.\nPR:N - A network attacker sending to an already configured UDP sockmap endpoint needs no local account or authentication. Creating the sockmap/BPF setup locally is privilege-gated by CAP_NET_ADMIN/CAP_BPF, but that is not required for the remote trigger scenario.\nUI:N - No victim user action is required after the affected service/socket is present. Packet receipt alone invokes the data-ready callback and verdict program.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM escape, sandbox boundary crossing, or separate security scope involved.\nC:N - The bug misinterprets UDP dev_scratch metadata as a struct net_device pointer and faults during dev_net()/ifindex access. I found no usable information disclosure or attacker-controlled read primitive.\nI:N - The investigated path is an invalid pointer dereference, not a use-after-free or out-of-bounds write. I found no attacker-controlled write, data modification, or control-flow hijack primitive.\nA:H - The documented failure is a kernel general protection fault/oops in softirq. It is repeatable with UDP packets against the affected sockmap verdict configuration, causing high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:33:51.091Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.12.94"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"6.18.36"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.0.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:22:37.019Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-53184","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:26:17.874900Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","lang":"en","type":"CWE","description":"CWE-476 NULL Pointer Dereference"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:57:26.714Z"}}]}}}