In the Linux kernel, the following vulnerability has been resolved:
udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and disconnect it from the address.
bind() sets SOCK_BINDPORT_LOCK on sk->sk_userlocks (but not SOCK_BINDADDR_LOCK), and connect() calls udp_lib_hash4() to put the socket into the 4-tuple hash table.
Then, __udp_disconnect() calls sk->sk_prot->rehash(sk).
It computes a new hash based on the wildcard address and moves the socket to a new slot in the 4-tuple hash table, leaving a garbage in the chain that no packet hits.
Let's remove such a socket from 4-tuple hash table when disconnected.
Note that udp_sk(sk)->udp_portaddr_hash needs to be udpated after udp_hash4_dec(hslot2) in udp_unhash4().
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.18.20-20.229Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-libbpfUpgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.18-debuginfoUpgrade kernel6.18-toolsUpgrade kernel6.18-libbpf-develUpgrade kernel6.18-modules-extraUpgrade perf6.18-debuginfoUpgrade kernel6.18-debuginfoUpgrade kernel6.18-headersUpgrade perf6.18Upgrade kernel6.18Upgrade bpftool6.18Upgrade kernel6.18-tools-develUpgrade kernel6.18-develUpgrade kernel6.18-libbpf-debuginfoUpgrade python3-perf6.18Upgrade kernel6.18-libbpf-staticUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-modules-extra-common | May 4, 2026 | Mar 25, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 25, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub