CVE-2026-43092

xsk: validate MTU against usable frame size on bind

State: Published
Severity: Not scored
Published: May 6, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before a55793e5a97d4e39bdb380873a9780fe0010bff6Affected 24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before f669d60db11dbabb96279f2b20f9d1cba43cddb2Affected 24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before 25e1e91a8da819924df0b16e3812d7b24c8ce133Affected 24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before b2f4daa6422fd6cc0cec969794dab4a88ea4cea1Affected 24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before 36ee60b569ba0dfb6f961333b90d19ab5b323fa9Affected
LinuxLinux	6.6Affected before 6.6Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before a55793e5a97d4e39bdb380873a9780fe0010bff6Affected
24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before f669d60db11dbabb96279f2b20f9d1cba43cddb2Affected
24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before 25e1e91a8da819924df0b16e3812d7b24c8ce133Affected
24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before b2f4daa6422fd6cc0cec969794dab4a88ea4cea1Affected
24ea50127ecf0efe819c1f6230add27abc6ca9d9 to before 36ee60b569ba0dfb6f961333b90d19ab5b323fa9Affected

LinuxLinux

6.6Affected
before 6.6Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.