Executive brief
The Linux kernel's XDP (eXpress Data Path) networking subsystem contains a memory layout bug in zero-copy packet handling. When AF_XDP packets are processed through CPU map redirects, the packet buffer can overlap with critical kernel metadata structures, causing memory corruption and kernel crashes. This affects systems using high-performance packet processing features.
Technical details
The vulnerability is a buffer overflow / memory layout corruption in the xdp_convert_zc_to_xdp_frame() function in net/core/xdp.c. When cloning an AF_XDP zero-copy packet into a kernel page, the function incorrectly advertises PAGE_SIZE as the frame size and allows packet data to occupy space reserved for skb_shared_info metadata. Additionally, it records zero headroom even when metadata is present, causing packets redirected through cpumap to either overlap with skb_shared_info or extend beyond the allocated page. The fix restricts the layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and correctly includes metadata length in frame headroom. The vulnerability allows denial of service via kernel panic (KASAN out-of-bounds detection) and potentially arbitrary memory corruption. The fix is available in commit 71283aaa6c65b3cec84caf1dc78560985737641f.
Affected products
- Linux Linux kernel multiple versions prior to fix b0d1beeff2a9
Timeline
- 2026-09-11: disclosed: CVE-2026-81002 published
- 2026-08-18: patched: Fix authored by Weiming Shi
- 2026-09-07: other: Patch merged to stable kernel by Greg Kroah-Hartman