Executive brief
A vulnerability was identified in the Linux kernel's Marvell MVPP2 network driver. The system incorrectly calculates the size of certain network data buffers, which could allow a specially crafted network packet to cause memory corruption. This could lead to system instability, crashes, or potential security bypasses on affected hardware.
Technical details
A vulnerability exists in the mvpp2 driver within the Linux kernel's networking subsystem. The driver utilizes both short and long Buffer Management (BM) pools, where short pool buffers may be smaller than the standard PAGE_SIZE. However, the XDP path was incorrectly initializing every xdp_buff with PAGE_SIZE as the frame size. This discrepancy allows XDP helpers like bpf_xdp_adjust_tail() to grow a packet beyond the actual allocated memory area, resulting in out-of-bounds memory corruption or kernel panics. The fix involves initializing the XDP buffer with the actual bm_pool->frag_size to ensure tailroom calculations match the physical buffer allocation.
Affected products
- Linux Linux 5.9 to 6.6.143, 6.1.176, 5.15.210
Timeline
- 2026-06-25: disclosed: CVE published
- 2026-06-19: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/3b8b0c3631b19faee53f0d15a49924129b063eec
- https://git.kernel.org/stable/c/910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e
- https://git.kernel.org/stable/c/9545cc5ef18ca22d031f2f47c157192460652359
- https://git.kernel.org/stable/c/994bd2b58d2bd08aa97ec0836cc813cfcb00d749
- https://git.kernel.org/stable/c/a3ee9231ccec6ec3be2de89c56f897055fd9eab1
- https://git.kernel.org/stable/c/ec8e1e5842bc0dbd4c272761f4db3651eecd0339
- https://git.kernel.org/stable/c/f3c6aa078927e6fe8121c9c591ddee8716c5305a