CVE-2026-53184

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1.0-rc6

Description An issue exists in the UDP receive path where the skb->dev field is repurposed as dev scratch via a union in sk buff. When a UDP socket is in a sockmap, the sk psock verdict recv function runs an attached SK SKB verdict program. If this program invokes socket-lookup helpers such as bpf sk lookup tcp(), bpf sk lookup udp(), or bpf skc lookup tcp(), the bpf skc lookup() function may attempt to dereference skb->dev. Because skb->dev still contains the dev scratch integer value rather than a valid pointer, the kernel triggers a general protection fault on a non-canonical address during softirq processing.

Recommendations Update the Linux kernel to a version where the skb->dev field is explicitly cleared before running the sockmap verdict to ensure bpf skc lookup() correctly falls back to sock net(skb->sk).