CVE-2026-74616xdp: reject clones that overrun skb_shared_info tailroom
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb_shared_info tailroom xdpf_clone() clones broadcast copies into a single page and sets frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that page like a normal XDP frame and expects the usual skb_shared_info tailroom at the end of the buffer. The current check only rejects frames whose linear xdp_frame header, headroom, and packet data exceed PAGE_SIZE. A source frame backed by a larger allocation can still satisfy that check while extending into the clone's required shared-info area. When such a clone is converted back into an skb, build_skb_around() places skb_shared_info over live packet bytes and later writes can corrupt XDP return metadata. Reject clones unless their linear area fits inside SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already enforced by the XDP-to-skb conversion path.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before 58408982fa39f9758124cec169f42854d6f98f35; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before 685edea27ac68d08fe4dbd3de74b858d2ad8e830; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before ba13763d667e008e185fedf592d53846a5b457d1; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before ef4b7c7046d29a67090de15af0da0d1ae8d1b192; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before fab820f1691a9e26d9031f18aae1e9ce09078f92; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0; from e624d4ed4aa8cc3c69d1359b0aaea539203ed266 before e48e8edbef2eb824201495daa5234560f632b23c | CNA record |
References
- https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35
- https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830
- https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1
- https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192
- https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92
- https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0
- https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.