Skip to main content

Linux Kernel CVE-2026-53184

| EUVDEUVD-2026-39275 HIGH
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-w59p-46mp-6wpv
Denial Of Service Linux Null Pointer Dereference Canonical
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify UDP service backed by sockmap verdict program
  2. Delivery
    Send crafted UDP datagram to target
  3. Exploit
    Packet processed in softirq runs SK_SKB verdict
  4. Execution
    Helper dereferences stale skb->dev (dev_scratch)
  5. Impact
    General protection fault crashes kernel (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the target to be running a non-default eBPF configuration: a UDP socket placed in a BPF sockmap with an attached SK_SKB verdict program, AND that verdict program must invoke a socket-lookup helper (bpf_sk_lookup_tcp, bpf_sk_lookup_udp, or bpf_skc_lookup_tcp), which is what reaches the faulting bpf_skc_lookup()/dev_net(skb->dev) code. Given that configuration, no authentication or user interaction is needed (CVSS PR:N/UI:N) - any attacker who can deliver a UDP datagram (IPv4 or IPv6) to the affected socket triggers the fault in softirq. Limiting factors: this configuration is uncommon and must be set up by a privileged operator (CAP_BPF/CAP_NET_ADMIN), it does not exist on default kernels, and impact is limited to a crash/DoS with no code execution or data disclosure; hosts without UDP sockmap verdict programs are not exploitable.
Impact

Signals are mixed and should be read together rather than off the headline CVSS 7.5. The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H correctly captures availability-only impact (a kernel GPF/panic, no confidentiality or integrity loss), but it understates the precondition: the system MUST be running a non-default BPF sockmap configuration with an SK_SKB verdict program that calls a socket-lookup helper - a setup that itself requires privileged (CAP_BPF/CAP_NET_ADMIN/root) configuration. EPSS is low at 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit is identified, so this is not a broad opportunistic threat. The realistic risk is a targeted DoS against the narrow set of hosts that deploy this exact eBPF data-path pattern. Note conflicts: the input tag 'Information Disclosure' contradicts the actual availability-only impact; and AV:N/AC:L/PR:N implies trivial remote exploitation, whereas the description shows a significant configuration dependency that should temper real-world likelihood. CWE is missing from the input.
Exploit ScenarioDerived

On a host that runs a UDP service whose socket is in a BPF sockmap with an SK_SKB verdict program that performs a socket lookup, an attacker simply sends a crafted UDP packet (IPv4 or IPv6) to that service. When the packet is processed in softirq the verdict program's socket-lookup helper dereferences the stale skb->dev value, causing a general protection fault and kernel crash (DoS). The bug pattern is reproducible (it surfaced via a syzkaller-style reproducer in the report), though no weaponized public exploit is identified.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Remote denial of service in the Linux kernel's UDP receive path affects systems where a UDP socket is placed in a BPF sockmap with an attached SK_SKB verdict program. Because skb->dev is repurposed as dev_scratch on the UDP path and never cleared before the verdict program runs, a verdict program that calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp) causes dev_net() to dereference a stale integer as a net_device pointer, triggering a general protection fault on a non-canonical address in softirq. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and the flaw is fixed; impact is availability only (kernel crash), not the 'Information Disclosure' the input tags suggest.

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13, or mainline 7.1, matching your kernel series; on distributions, apply the corresponding distro update (e.g. Canonical/Ubuntu) once it ships the backport. The fix commits are at https://git.kernel.org/stable/c/1b585673a2249f13678e7ac443ac683ba767e0b6 and the related stable hashes, with tracking at https://nvd.nist.gov/vuln/detail/CVE-2026-53184. If you cannot patch immediately, the most effective compensating control is to avoid the vulnerable data path: do not attach SK_SKB verdict programs to UDP sockets in a sockmap, or remove socket-lookup helper calls (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp) from any UDP verdict program - trade-off is loss of that BPF-based steering/filtering functionality. Additionally, restrict who can load/attach BPF programs (drop CAP_BPF/CAP_NET_ADMIN from untrusted workloads, set kernel.unprivileged_bpf_disabled=1), which prevents the vulnerable configuration from being introduced but does not help if the program is legitimately required.

Affected VersionsENISA

Linux patch: 6.1.176
Linux 6.0
Linux 965b57b469a589d64d81b1688b38dcb537011bb0 <3c94f241f776562c489876ff506f366224565c21
Linux 965b57b469a589d64d81b1688b38dcb537011bb0 <7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1
Linux patch: 6.18.36
Linux patch: 7.0.13
Linux patch: 6.6.143
Linux patch: 7.1
Linux patch: 6.12.94
Linux patch: 0
Linux 965b57b469a589d64d81b1688b38dcb537011bb0 <1b585673a2249f13678e7ac443ac683ba767e0b6
Linux 965b57b469a589d64d81b1688b38dcb537011bb0 <6822eed69572000a181fa4e31fceacc60918c471
Linux 965b57b469a589d64d81b1688b38dcb537011bb0 <263779a6beff03b8b06f6d25566cb0f45af361f2
Linux 965b57b469a589d64d81b1688b38dcb537011bb0 <90d35188aaa92b8f8b23f66335e0e91bf60103a3

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in the kernel networking stack interaction between UDP receive and BPF sockmap/sk_psock processing. sk_buff contains a union { struct net_device *dev; unsigned long dev_scratch; }; on the UDP path udp_set_dev_scratch() overloads this field to cache truesize/state, so skb->dev no longer holds a valid device pointer. When a socket is in a sockmap, sk_data_ready is sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor() (sk_psock_verdict_recv) to run the attached SK_SKB program in softirq. The socket-lookup helper path bpf_skc_lookup() does 'if (skb->dev) caller_net = dev_net(skb->dev);' - and since dev_scratch is a non-NULL integer (e.g. 0x1010000800004a0), dev_net() dereferences garbage. The root cause class is a type/field confusion over a union (akin to CWE-843 type confusion / use of a stale pointer value), even though the input lists CWE as N/A. The fix clears skb->dev so the helper falls back to sock_net(skb->sk), which skb_set_owner_sk_safe() already set.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.9 MEDIUM

Remote UDP packet triggers it (AV:N, PR:N/UI:N), but it only fires under a rare sockmap+verdict-program config so AC:H; impact is crash-only (A:H, C:N/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

udp: clear skb->dev before running a sockmap verdict

On the UDP receive path skb->dev is repurposed as dev_scratch (the truesize/state cache set by udp_set_dev_scratch()), through the union { struct net_device *dev; unsigned long dev_scratch; } in sk_buff.

When a UDP socket is in a sockmap, sk_data_ready is sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor() (sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq. If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp), bpf_skc_lookup() does:

if (skb->dev) caller_net = dev_net(skb->dev);

skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net() dereferences it as a struct net_device * and the kernel takes a general protection fault on a non-canonical address in softirq:

Oops: general protection fault, probably for non-canonical address 0x1010000800004a0 CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full) RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline] RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047 Call Trace: <IRQ> bpf_prog_4675cb904b7071f8+0x12e/0x14e bpf_prog_run_pin_on_cpu+0xc6/0x1f0 sk_psock_verdict_recv+0x1ba/0x350 udp_read_skb+0x31a/0x370 sk_psock_verdict_data_ready+0x2e3/0x600 __udp_enqueue_schedule_skb+0x4c8/0x650 udpv6_queue_rcv_one_skb+0x3ec/0x740 udp6_unicast_rcv_skb+0x11d/0x140 ip6_protocol_deliver_rcu+0x61e/0x950 ip6_input_finish+0xa9/0x150 NF_HOOK+0x286/0x2f0 ip6_input+0x117/0x220 NF_HOOK+0x286/0x2f0 __netif_receive_skb+0x85/0x200 process_backlog+0x374/0x9a0 __napi_poll+0x4f/0x1c0 net_rx_action+0x3b0/0x770 handle_softirqs+0x15a/0x460 do_softirq+0x57/0x80 </IRQ>

The rmem charge that dev_scratch accounted for is released by skb_recv_udp() on dequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear skb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which skb_set_owner_sk_safe() set just above.

Executive ViewAI

Why It Matters

CVE-2026-53184 affects Linux kernels with specific BPF sockmap configurations, allowing remote attackers to trigger kernel crashes and service unavailability. No public exploit identified at time of analysis, and EPSS is low at 0.2%, but organizations running vulnerable kernel versions on systems with UDP socket and BPF sockmap setups require remediation. A vendor patch is available and should be prioritized for affected infrastructure.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
Ubiquitous
Linux kernel is ubiquitous, though the vulnerable UDP sockmap/verdict config is uncommon
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53184 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373750 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/1b585673a2249f13678e7ac443ac683ba767e0b6 REF https://git.kernel.org/stable/c/263779a6beff03b8b06f6d25566cb0f45af361f2 REF https://git.kernel.org/stable/c/3c94f241f776562c489876ff506f366224565c21 REF https://git.kernel.org/stable/c/6822eed69572000a181fa4e31fceacc60918c471 REF https://git.kernel.org/stable/c/7d6d92d000ebe3a845a17c165c1d3a70c5d84fe1 REF https://git.kernel.org/stable/c/90d35188aaa92b8f8b23f66335e0e91bf60103a3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy