CVE-2026-53184

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udp: clear skb->dev before running a sockmap verdict

On the UDP receive path skb->dev is repurposed as dev_scratch (the

truesize/state cache set by udp_set_dev_scratch()), through the

union { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.

When a UDP socket is in a sockmap, sk_data_ready is

sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor()

(sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq.

If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp,

bpf_skc_lookup_tcp), bpf_skc_lookup() does:

if (skb->dev)

caller_net = dev_net(skb->dev);

skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net()

dereferences it as a struct net_device * and the kernel takes a general

protection fault on a non-canonical address in softirq:

Oops: general protection fault, probably for non-canonical address 0x1010000800004a0

CPU: 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References