CVE-2026-23331

In the Linux kernel, the following vulnerability has been resolved:

udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.

Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and disconnect it from the address.

bind() sets SOCKBINDPORTLOCK on sk->skuserlocks (but not SOCKBINDADDRLOCK), and connect() calls udplib_hash4() to put the socket into the 4-tuple hash table.

Then, __udpdisconnect() calls sk->skprot->rehash(sk).

It computes a new hash based on the wildcard address and moves the socket to a new slot in the 4-tuple hash table, leaving a garbage in the chain that no packet hits.

Let's remove such a socket from 4-tuple hash table when disconnected.

Note that udpsk(sk)->udpportaddrhash needs to be udpated after udphash4dec(hslot2) in udpunhash4().