Executive brief
A vulnerability was identified in the Linux kernel's high-performance networking component (AF_XDP). The system failed to properly verify that network packet sizes (MTU) fit within the memory buffers allocated for 'zero-copy' operations. This could lead to system instability or a denial-of-service condition if a local user configures network settings that exceed the available memory space.
Technical details
A vulnerability in the Linux kernel's XDP (Express Data Path) socket (AF_XDP) implementation arises from a lack of MTU validation during the bind process. Specifically, the kernel accepted zero-copy (ZC) pool configurations without verifying that the device Maximum Transmission Unit (MTU) fits into the usable frame space provided by the UMEM chunk, especially after accounting for headroom and tailroom. An attacker with local privileges could potentially trigger a kernel panic or denial-of-service by configuring a UMEM chunk size (e.g., 2k) that is insufficient for the standard MTU (1500) or by exceeding the hardware's supported Rx buffer chain length. The fix introduces validation logic in 'xp_assign_dev' to ensure the MTU plus padding does not exceed the calculated frame size multiplied by the maximum supported segments.
Affected products
- Linux Linux Kernel 6.6 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-02: other: Patch authored by Maciej Fijalkowski
- 2026-05-06: disclosed: CVE published by kernel.org
- 2026-05-19: advisory: NVD analysis and enrichment completed
References
- https://git.kernel.org/stable/c/25e1e91a8da819924df0b16e3812d7b24c8ce133
- https://git.kernel.org/stable/c/36ee60b569ba0dfb6f961333b90d19ab5b323fa9
- https://git.kernel.org/stable/c/a55793e5a97d4e39bdb380873a9780fe0010bff6
- https://git.kernel.org/stable/c/b2f4daa6422fd6cc0cec969794dab4a88ea4cea1
- https://git.kernel.org/stable/c/f669d60db11dbabb96279f2b20f9d1cba43cddb2