CVE-2026-43093

xsk: tighten UMEM headroom validation to account for tailroom and min frame

State: Published
Severity: 7.8 High
Published: May 6, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xsk: tighten UMEM headroom validation to account for tailroom and min frame

The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore if multi-buffer would come to play then skb_shared_info stored at the end of XSK frame would be corrupted.

HW typically works with 128-aligned sizes so let us provide this value as bare minimum.

Multi-buffer setting is known later in the configuration process so besides accounting for 128 bytes, let us also take care of tailroom space upfront.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
LinuxLinux	99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 5f123bc278bf4e3283d8606321bebbfd299f4384Affected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 1a6051cd7e3e4c54ff3854a43b638b9292af5e67Affected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 8769708add9eadeea8041a9761771bb715a87104Affected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before a03975beb9f6af0d8ac051e30b2abeabe618414fAffected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 0ec4d3f6e6934deb843b561ae048cd17218e5ad1Affected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12Affected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 6523bc1b40e69301f24c14338b762af4739d6d39Affected 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before a315e022a72d95ef5f1d4e58e903cb492b0ad931Affected ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6eeAffected 25c9cdef57488578da21d99eb614b97ffcf6e59fAffected 98d3c852e63b49129515dd18c875999efaf8530aAffected 4.19.118 to before 4.20Affected 5.4.35 to before 5.5Affected 5.6.7 to before 5.7Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 5f123bc278bf4e3283d8606321bebbfd299f4384Affected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 1a6051cd7e3e4c54ff3854a43b638b9292af5e67Affected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 8769708add9eadeea8041a9761771bb715a87104Affected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before a03975beb9f6af0d8ac051e30b2abeabe618414fAffected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 0ec4d3f6e6934deb843b561ae048cd17218e5ad1Affected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12Affected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before 6523bc1b40e69301f24c14338b762af4739d6d39Affected
99e3a236dd43d06c65af0a2ef9cb44306aef6e02 to before a315e022a72d95ef5f1d4e58e903cb492b0ad931Affected
ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6eeAffected
25c9cdef57488578da21d99eb614b97ffcf6e59fAffected
98d3c852e63b49129515dd18c875999efaf8530aAffected
4.19.118 to before 4.20Affected
5.4.35 to before 5.5Affected
5.6.7 to before 5.7Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.