Executive brief
The Linux kernel's network packet handling code contains a bug in how it tracks packet fragment lengths when XDP (eXpress Data Path) programs modify network packets. When fragments are shrunk, the kernel incorrectly calculates the linear data boundary, causing it to copy kernel memory structures and pointers to user applications, potentially exposing sensitive kernel addresses and corrupting received network data.
Technical details
This is an information disclosure vulnerability in the generic XDP packet processing path. When an XDP program adjusts fragmented packet sizes, bpf_prog_run_generic_xdp() updates the skb->data_len field but fails to synchronize skb->len, causing skb_headlen() to report a larger linear area than actually exists. On UDP receive paths, __skb_datagram_iter() then copies memory past the actual linear packet boundary to userspace, including the kernel structure skb_shared_info which contains kernel pointers and metadata. The vulnerability requires network reachability to a system running XDP programs that adjust packet fragments (such as on veth pairs or similar setups). An attacker can trigger data corruption and leak kernel addresses by sending crafted UDP datagrams. The fix synchronizes length accounting by subtracting old data_len before updating and adding new data_len afterwards.
Affected products
- Linux Linux kernel affected versions include recent stable releases; patch applied August 2026
Timeline
- 2026-08-22: disclosed
- 2026-08-07: patched