CVE-2026-23048 udp: call skb_orphan() before skb_attempt_defer_free()
A missing skb_orphan call in the Linux kernel UDP receive path can trigger a warning and potential instability, requiring a kernel patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23048?
CVE-2026-23048 is a denial of service vulnerability in Linux, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
udp: call skb_orphan() before skb_attempt_defer_free()
Standard UDP receive path does not use skb->destructor.
But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb().
This then triggers this warning in skb_attempt_defer_free():
DEBUG_NET_WARN_ON_ONCE(skb->destructor);
We must call skb_orphan() to fix this issue.
Which versions are affected by CVE-2026-23048?
How do I fix CVE-2026-23048?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23048 being exploited?
There is no known exploitation of CVE-2026-23048 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-23048, DEBIAN-CVE-2026-23048, GHSA-h5xw-xh97-3j7m, UBUNTU-CVE-2026-23048.