CVE-2026-81002xdp: fix zero-copy frame layout
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page and advertises PAGE_SIZE as its frame size. It allows the copied frame to occupy the page tail needed by skb_shared_info and records zero headroom even when metadata separates the frame header from packet data. An AF_XDP zero-copy packet redirected through cpumap can therefore make the skb overlap skb_shared_info or place it beyond the allocated page. Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the metadata length in frame headroom. Redirect callers already handle a NULL conversion result. BUG: KASAN: slab-out-of-bounds in skb_gro_receive Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146 Call Trace: skb_gro_receive (net/core/gro.c:174) udp_gro_receive (net/ipv4/udp_offload.c:812) inet_gro_receive (net/ipv4/af_inet.c:1539) dev_gro_receive (net/core/gro.c:515) gro_receive_skb (net/core/gro.c:633) cpu_map_kthread_run (kernel/bpf/cpumap.c:395) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) Kernel panic - not syncing: KASAN: panic_on_warn set ...
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 22092730129077c302d8c947bbe0876f0280c528; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before ced3e18cd9b9caf630aaa1e1eac305f5192ba896; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 6de17275b3ccdf9887568b07e54da2e3597217cf; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 444216dacdbebd3e52d5e704facafbb230da09e9; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 15d1f3c0dbe7a740f779337deb39f23cd8d002c8; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 68d7cc5512238693670fc19c7a615df631e10edf; from b0d1beeff2a97a0cf1965ea8f1d13b8973f22582 before 71283aaa6c65b3cec84caf1dc78560985737641f | CNA record |
References
- https://git.kernel.org/stable/c/dcb6db9ca6515fcd3e00c93ec5e27dc7a0a7012f
- https://git.kernel.org/stable/c/22092730129077c302d8c947bbe0876f0280c528
- https://git.kernel.org/stable/c/ced3e18cd9b9caf630aaa1e1eac305f5192ba896
- https://git.kernel.org/stable/c/6de17275b3ccdf9887568b07e54da2e3597217cf
- https://git.kernel.org/stable/c/444216dacdbebd3e52d5e704facafbb230da09e9
- https://git.kernel.org/stable/c/15d1f3c0dbe7a740f779337deb39f23cd8d002c8
- https://git.kernel.org/stable/c/68d7cc5512238693670fc19c7a615df631e10edf
- https://git.kernel.org/stable/c/71283aaa6c65b3cec84caf1dc78560985737641f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.