Executive brief
A flaw in the Linux kernel's veth (virtual Ethernet) network driver causes incorrect memory length accounting when Extended Data Path (XDP) programs modify packet fragments. This can result in kernel memory being copied to user applications, exposing sensitive kernel pointers and data structures, or causing data corruption in received UDP packets.
Technical details
The vulnerability is a skb (socket buffer) length accounting bug in the veth driver's XDP fragment handling. When an XDP program adjusts fragment sizes, veth_xdp_rcv_skb() updates skb->data_len but fails to adjust skb->len accordingly, causing skb_headlen() to report a size larger than the actual linear area. Additionally, bpf_xdp_pull_data() can advance data_end while leaving fragments present, triggering incorrect assertions. The result is that __skb_datagram_iter() can copy kernel memory including struct skb_shared_info fields and kernel pointers to userspace. The fix properly synchronizes skb->len and skb->data_len before and after fragment adjustment, and uses skb_set_tail_pointer() instead of __skb_put() for non-linear skbs.
Affected products
- Linux Linux kernel Vulnerable versions unspecified in advisory
Timeline
- 2026-08-22: disclosed
- 2026-08-22: patched: Fix included in advisory describing resolution to veth_xdp_rcv_skb() and bpf_xdp_pull_data()