Executive brief
A vulnerability in the Linux kernel's networking component could allow a remote attacker to crash the system. The issue exists in the UDP-Lite protocol implementation, where certain internal initialization failures are not properly handled. An exploit could lead to a complete denial of service, impacting system availability and business operations.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's UDP-Lite implementation within the __udp_enqueue_schedule_skb() function. The root cause is a failure to handle error returns from socket initialization functions (udp_init_sock and udpv6_init_sock) in udplite_sk_init() and udplitev6_sk_init(). When these initializations fail, subsequent attempts to access the udp_prod_queue result in a NULL pointer dereference. This can be triggered remotely via network traffic if the UDP-Lite protocol is active. Patches have been released for various stable kernel branches to ensure initialization errors are correctly propagated and handled.
Affected products
- Linux Linux Kernel 6.18 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-02-19: disclosed: Vulnerability reported by syzbot and patch authored
- 2026-03-04: patched: Patch committed to stable tree
- 2026-05-06: advisory: CVE-2026-43164 published