CVE-2026-23343
Integer Overflow in Linux Kernel XDP Fragment Tailroom Causes Memory Corruption
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.18 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.130 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.77 (exc) |
| linux | linux_kernel | From 5.18.1 (inc) to 6.1.167 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's XDP (Express Data Path) implementation. It arises because many ethernet drivers report the XDP receive queue fragment size as the same as the DMA write size, but the function bpf_xdp_frags_increase_tail() expects a true size instead.
Due to this mismatch, under certain conditions, such as with the ixgbevf driver where the maximum DMA write size is 3 KB, the reported fragment size is incorrect (3 KB instead of the expected 4 KB). This causes the calculated tailroom (space left at the end of a buffer) to become negative.
Because tailroom is stored as an unsigned integer, a negative value is interpreted as a very large positive number, leading to the system attempting to grow the tail beyond the buffer's actual capacity. This results in memory corruption and various unpredictable crashes or call traces.
How can this vulnerability impact me? :
This vulnerability can lead to unspecific memory corruption issues in the Linux kernel when using affected ethernet drivers and XDP features. The memory corruption can cause system instability, including segmentation faults and general protection faults, potentially crashing processes or the entire system.
Such crashes and memory corruption can disrupt network operations, degrade system reliability, and may be exploited to cause denial of service or other unpredictable behavior.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as unspecific memory corruption issues and can cause kernel crashes or segfaults related to XDP (Express Data Path) operations, especially when using xskxceiver with certain ethernet drivers like ixgbevf.
Detection can involve monitoring kernel logs for specific error messages such as segfaults in xskxceiver, general protection faults, or unusual call traces related to XDP tailroom calculations.
You can check kernel logs using commands like:
- dmesg | grep -i xskxceiver
- journalctl -k | grep -i 'general protection fault'
- journalctl -k | grep -i segfault
Additionally, monitoring for unusual crashes or faults in network-related processes or drivers can help detect this issue.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by ensuring that the Linux kernel properly warns when the calculated tailroom is negative and avoids memory corruption by returning an error instead of allowing tail growth.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability.
- Avoid running workloads or applications that use xskxceiver with XDP_ADJUST_TAIL_GROW_MULTI_BUFF on affected ethernet drivers until the kernel is updated.
- Monitor kernel logs for signs of the issue and restart affected services or systems if crashes occur.