net UDP Peek Checksum Race

Vulnerability analysis

When a peeked datagram is larger than the receiver's buffer, the original receive path could complete checksum validation and then make a second, state-dependent checksum-and-copy decision on the same packet. That repeated handling was unsafe for a short destination buffer and could corrupt kernel memory, leading to arbitrary code execution. The fix retains the result of the first validation and uses the copy path that safely handles truncated user buffers, avoiding a second checksum calculation in both IPv4 and IPv6. An unauthenticated remote sender can reach the flaw through a reachable UDP socket when a target process performs a peek with a buffer smaller than the arriving datagram; no special hardware or local attacker privilege is required.