Riskcovery

CVE-2026-23377

ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz

State
Published
Severity
Not scored
Published
Mar 25, 2026
Updated
Oct 30, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz

The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write size. Different assumptions in ice driver configuration lead to negative tailroom.

This allows to trigger kernel panic, when using XDP_ADJUST_TAIL_GROW_MULTI_BUFF xskxceiver test and changing packet size to 6912 and the requested offset to a huge value, e.g. XSK_UMEM__MAX_FRAME_SIZE * 100.

Due to other quirks of the ZC configuration in ice, panic is not observed in ZC mode, but tailroom growing still fails when it should not.

Use fill queue buffer truesize instead of DMA write size in XDP RxQ info. Fix ZC mode too by using the new helper.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79 to before f2b29bbe355221a65c3eccf9500e5e33e4f1cb5cAffected
  • 2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79 to before 6aed180a44b1c0a3971107fa052a41b03acdb31eAffected
  • 2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79 to before 2a2927e95cf1b8efb15bcb741bbd06c9bb0537b7Affected
  • 2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79 to before b0f05100e8795aadd1c0606bae9caefbda070d63Affected
  • 2fba7dc5157b6f85dbf1b8e26e63a724db1f3d79 to before e142dc4ef0f451b7ef99d09aaa84e9389af629d7Affected
LinuxLinux
  • 6.3Affected
  • before 6.3Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.60 through 6.18.*Not affected
  • 6.19.7 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.