CVE-2026-81002

xdp: fix zero-copy frame layout

State: Published
Severity: 9.8 Critical
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xdp: fix zero-copy frame layout

xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page.

Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result.

BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012fAffected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 22092730129077c302d8c947bbe0876f0280c528Affected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before ced3e18cd9b9caf630aaa1e1eac305f5192ba896Affected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 6de17275b3ccdf9887568b07e54da2e3597217cfAffected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 444216dacdbebd3e52d5e704facafbb230da09e9Affected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 15d1f3c0dbe7a740f779337deb39f23cd8d002c8Affected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 68d7cc5512238693670fc19c7a615df631e10edfAffected b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 71283aaa6c65b3cec84caf1dc78560985737641fAffected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012fAffected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 22092730129077c302d8c947bbe0876f0280c528Affected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before ced3e18cd9b9caf630aaa1e1eac305f5192ba896Affected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 6de17275b3ccdf9887568b07e54da2e3597217cfAffected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 444216dacdbebd3e52d5e704facafbb230da09e9Affected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 15d1f3c0dbe7a740f779337deb39f23cd8d002c8Affected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 68d7cc5512238693670fc19c7a615df631e10edfAffected
b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 to before 71283aaa6c65b3cec84caf1dc78560985737641fAffected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.