Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause memory corruption. The issue exists in how the system manages memory buffers for high-performance packet processing (AF_XDP). If exploited, this could lead to a system crash or potentially allow an attacker to gain elevated privileges.
Technical details
A vulnerability was identified in net/xdp/xdp_umem.c within the Linux kernel's AF_XDP implementation. The function xdp_umem_reg() failed to properly validate user-supplied headroom sizes, potentially leaving insufficient space for minimum-sized Ethernet frames or tailroom. In multi-buffer scenarios, this lack of validation can lead to the corruption of skb_shared_info stored at the end of an XSK frame. A local attacker with low privileges could exploit this to cause memory corruption, leading to a denial of service or local privilege escalation. Patches have been released across multiple stable kernel branches to tighten headroom validation.
Affected products
- Linux Linux Kernel 5.6.7 to 5.7, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 4.19.118 to 4.20, 5.4.35 to 5.5, 5.7.1 to 6.6.136
Timeline
- 2026-04-02: other: Patch authored
- 2026-05-06: disclosed: Initial disclosure and NVD publication
- 2026-05-06: advisory
References
- https://git.kernel.org/stable/c/0ec4d3f6e6934deb843b561ae048cd17218e5ad1
- https://git.kernel.org/stable/c/6523bc1b40e69301f24c14338b762af4739d6d39
- https://git.kernel.org/stable/c/9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12
- https://git.kernel.org/stable/c/a03975beb9f6af0d8ac051e30b2abeabe618414f
- https://git.kernel.org/stable/c/a315e022a72d95ef5f1d4e58e903cb492b0ad931