CVE-2026-64355
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but without valid frag metadata, and the later free path can interpret uninitialized tail data as skb_shared_info, leading to an out-of-bounds access during frame return. Reject fragmented native XDP frames in dev_map_enqueue_clone(). Add the same restriction to the generic XDP clone path in dev_map_redirect_clone(). Generic XDP represents fragmented packets as nonlinear skbs, and rejecting them here keeps clone-based broadcast support aligned between native and generic XDP.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64355
EUVD
EUVD-2026-48899

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) subsystem. It occurs when devmap broadcast redirects clone packets for all but the last destination. For native XDP, cloning copies only linear xdp_frame data, but fragmented frames retain skb_shared_info in tailroom outside the linear area. This leads to an out-of-bounds access during frame return when XDP_FLAGS_HAS_FRAGS is set without valid fragment metadata.

Detection Guidance

This vulnerability involves fragmented frames in devmap with XDP. Detection requires checking kernel logs for XDP-related errors or crashes, particularly during packet processing. Monitor for kernel oops messages or errors in dmesg related to XDP or devmap operations.

Impact Analysis

This vulnerability could allow an attacker to trigger an out-of-bounds memory access in the Linux kernel, potentially leading to system crashes, privilege escalation, or denial-of-service conditions. Systems using XDP (eXpress Data Path) with devmap broadcast functionality are particularly affected.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable XDP devmap broadcast if not critical. Update network drivers and XDP-related components. Monitor kernel logs for signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart