In the Linux kernel, the following vulnerability has been resolved:

udp: call skb_orphan() before skb_attempt_defer_free()

Standard UDP receive path does not use skb->destructor.

But skmsg layer does use it, since it calls skb_set_owner_sk_safe() from udp_read_skb().

This then triggers this warning in skb_attempt_defer_free():

DEBUG_NET_WARN_ON_ONCE(skb->destructor);

We must call skb_orphan() to fix this issue.

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Redhat_linux	—	No solution exists	Jul 17, 2026	Feb 4, 2026

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

CVE-2026-23048: Undefined Security Weakness