CVE-2026-74616

xdp: reject clones that overrun skb_shared_info tailroom

State: Published
Severity: 9.8 Critical
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xdp: reject clones that overrun skb_shared_info tailroom

xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer.

The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata.

Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before 58408982fa39f9758124cec169f42854d6f98f35Affected e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before 685edea27ac68d08fe4dbd3de74b858d2ad8e830Affected e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before ba13763d667e008e185fedf592d53846a5b457d1Affected e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before ef4b7c7046d29a67090de15af0da0d1ae8d1b192Affected e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before fab820f1691a9e26d9031f18aae1e9ce09078f92Affected e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0Affected e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before e48e8edbef2eb824201495daa5234560f632b23cAffected
LinuxLinux	5.14Affected before 5.14Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before 58408982fa39f9758124cec169f42854d6f98f35Affected
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before 685edea27ac68d08fe4dbd3de74b858d2ad8e830Affected
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before ba13763d667e008e185fedf592d53846a5b457d1Affected
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before ef4b7c7046d29a67090de15af0da0d1ae8d1b192Affected
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before fab820f1691a9e26d9031f18aae1e9ce09078f92Affected
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0Affected
e624d4ed4aa8cc3c69d1359b0aaea539203ed266 to before e48e8edbef2eb824201495daa5234560f632b23cAffected

LinuxLinux

5.14Affected
before 5.14Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.